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1 GLOSSARY 


System Administrator: 


Archive: 


Backup: 


Carving: 


CLI: 
Database: 


Delete: 


Disk Image: 


Dump: 


File: 


File System: 


Folder: 


IP Address: 


LIMS: 


Metadata: 


Midnight Commander: 


Moscow Data: 


Moscow LIMS: 


INTELLIGENCE AND INVESTIGATIONS DEPARTMENT 


An “administrator” account is a user account that allows that user to make changes that 
will affect other users. For example, an administrator can change security settings, 
install software and hardware, and access all files on the computer. 


An archive is a single file that contains multiple files and or folders. They are commonly 
used for backing up data and transferring multiple files between users. 


A backup is a copy of one or more files created as an alternate in case the original data 
is lost or becomes unusable. 


Carving is a method of rebuilding deleted files from fragments when initial metadata 
such as the file name, creation date, data path had been removed. 


A command line interface (CLI) is a text-based interface used for entering commands. 
A database is a data structure that stores organized information. 


Delete is computer terminology for removing or erase. When you delete a file, it is not 
erased, but instead the reference to the file is removed. This means deleted files are 
still intact until they are written over. Special software can recover some deleted files. 


A disk image is a file containing a “byte-by-byte” copy of a hard drive. 


A database dump (also, “SQL dump”) contains records of the table structure and or the 
data from a database and is usually in the form of a list of SQL statements. 


A file is a collection of data stored in one unit, identified by a filename. It can be a 
document, picture, audio or video stream, data library, application, or other collection of 
data. 


A file system organises all the files on the disk. The file system is created when a user 
initializes or formats your hard disk. 


Digital folders are designed for organizing files and storing documents. Folders can 
contain subfolders which may contain additional subfolders and files. 


An Internet Protocol address is an address that identifies a device on the Internet or a 
local network. It allows a system to be recognized by other systems connected via the 
Internet protocol. 


Laboratory Information Management System is a software-based solution with features 
that support a laboratory's operations. 


Metadata is data describing or giving information about another data. For example, the 
metadata of files can be its creation date, modification date, encoding. 


Midnight Commander is a visual file manager that allows a user to copy, move and 
delete files. 


The Moscow Data comprises all the Moscow Laboratory servers and computer 
instruments that were forensically imaged during the Data Retrieval Mission (i.e. LIMS 
server, Server ONE, Disks provided by the Investigative Committee of Russia and 
computer instruments) and their content (e.g. LIMS data, Raw Data and PDF files). 


The Moscow LIMS corresponds to the forensic image of the LIMS Database that was 
performed on 12 January 2019 in the Moscow laboratory during the Data Retrieval 
Mission. WADA formally took possession of the data on 17 January 2019. 
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MySQL: 


NTP: 
PDF: 


Raw Data File: 


Root User: 


Script: 
WADA LIMS: 


Web-Interface: 


Web-Server: 
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MySQL is an open source relational database management system. Based on the 
Structure Query Language (SQL), which is used for adding, removing, and modifying 
information in the database. 


NTP servers are “time” servers designed to sync client systems time with official time. 


A Portable Document Format (PDF) is a file format designed to present documents 
consistently across multiple devices and platforms. 


In the framework of the investigation, a Raw Data is the result of the Initial Testing or 
Confirmation Procedure analysis of a sample aliquot. Raw Data indicates whether a 
substance or metabolite was detected by an analytical instrument. 


“Root” is the name of the user who has administrative privileges on a Unix or Linux 
server. 


A computer script is a list of commands that are executed by a certain program or 
scripting engine. Scripts may be used to automate processes on a local computer or to 
generate Web pages on the Web. 


The WADA LIMS corresponds to the LIMS SQL Dump provided by a Whistleblower to 
the Intelligence and Investigations Department on 31 October 2017. The Dump was 
performed on 3 September 2015. 


The interaction between a user and software running on a Web server. 


A web server is a system that delivers content or services to end users over the internet. 
Aweb server consists of a physical server, server operating systems and software used 
to facilitate the communication. 
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2 EXECUTIVE SUMMARY 


This is the final report to the Compliance Review 
Committee (CRC) regarding the Intelligence and 
Investigations Department investigation of the “Moscow 
Data”. More specifically, whether the data provided by 
Russian authorities in response to the “Reinstatement 
Conditions”* was an authentic copy. 


The purpose of this report is fivefold. 


Firstly, detail the result of the WADA Expert assessment 
of the “New Data” received from Russian Minister of 
Sport, Pavel Kolobkov (Minister Kolobkov), on 23 
October 2019 (New Data). 


Secondly, detail the result of the WADA Independent 
Expert assessment of the “Russia Forensic 
Investigation’? and answers the question whether the 
Russia Forensic Investigation disturbs the findings of 
the “WADA Technical Report’* (Independent Expert 
Evaluation). 


Thirdly, detail the result of investigations conducted into 
the forensic veracity of three disks (ICR Disks) 
purportedly seized from the Moscow Laboratory by the 
Investigative Committee of the Russian Federation 
(Investigative Committee) on 21 July 2016. 


Fourthly, detail the result of the meeting between the 
Independent Experts and Russian Experts held in 
Lausanne, Switzerland on 14 November 2019 (Expert 
Meeting). 


Lastly, report the impact of the data manipulation and 
deletion, more specifically missing Raw Data files, on 
the ability to conduct complete and _ thorough 
investigation of “Target Group”® athletes (Impact). 


This report is to be read in conjunction with the 
“Preliminary Report” and “CRC Report” published to the 
CRC on 15 May 2019 and 6 September 2019, 
respectively. 


Overview 


On 6 September 2019, the Intelligence and 
Investigations Department reported (CRC Report) to 


1 Moscow Data: Moscow Laboratory’s LIMS database covering the 
period 1 January 2012 to 31 August 2015, along with the data 
underlying the findings reported in the LIMS database for that period. 


2 On 20 September 2018 the WADA Executive Committee reinstated 
the Russian Anti-Doping Agency (“RUSADA’”) to the list of Code- 
compliant Signatories, on condition that RUSADA and the Ministry 
‘must procure’ the provision to WADA by 31 December 2018 of the 
Moscow Data. 
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the CRC that based on observable digital forensic 
evidence detailed in the WADA Technical Report, the 
Moscow Data was altered before being provided to 
WADA on 17 January 2019. These alterations include 
backdating, disk formatting, deleted files, deleted 
database backups, secure erased files, selectively 
removed command history entries (Command Logs), 
as well as replaced databases, deleted records and 
removed tables. 


On 17 September 2019, the CRC Report was provided 
to Minister Kolobkov and on 8 October 2019, the 
Minister responded by producing the Russia Forensic 
Investigation which disputed the findings of the CRC 
Report. 


In short, the Russia Forensic Investigation asserts 
compliance with the Reinstatement Conditions and 
denies data manipulation. Moreover, it claims the LIMS 
has been so contaminated with “falsified results” by 
Doctor Grigory Rodchenkov (Doctor Rodchenkov), 
Doctor Timofey Sobolevsky (Doctor Sobolevsky) and 
Oleg Migachev (Mr Migachev), that it is of no 
evidentiary value and the only reliable evidence is Raw 
Data. 


The Russia Forensic Investigation also identified 
additional data sources (i.e. the New Data) potentially 
relevant to the Reinstatement Conditions. The existence 
of the New Data was not previously known to WADA. 


On 23 October 2019, following CRC request, Minister 
Kolobkov produced the New Data to the Intelligence and 
Investigations Department in Geneva, Switzerland. It 
was then examined by the Independent Experts. 


New Data 


The New Data is not a trustworthy source of information 
for evaluating claims made in the Russia Forensic 
Investigation. Furthermore, observed digital traces of 
data alteration and forged database backups in the New 
Data raises questions about its integrity and 
completeness. 


3 This folio is comprised of Russia Statement of Facts, Russia 
Technical Report, Counter Research and Attachment E - Answers to 
Technical Questions — See Attachments B, C, D and E, respectively. 


4 See Attachment A - Digital Forensic Examination Report (“PFS 
19.0333”) (“WADA Technical Report’) dated 15 August 2019. 


5 Target Group: 298 athletes identified as having the most suspicious 
LIMS data based on the WADA LIMS. 
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Independent Expert Evaluation 


Following review, Independent Experts state that the 
Russia Forensic Investigation does not disturb the 
findings of the WADA Technical Report. 


Moreover, during their evaluation, Independent Experts 
discovered that between 25 November 2018 and 10 
January 2019, a person or persons unknown fabricated, 
modified and deleted messages (Forum Messages) 
contained within the Moscow LIMS.§® 


More specifically, Forum Messages referenced by the 
Russia Forensic Investigation as evidencing extortion 
and the manipulation of analysis results by Doctor 
Rodchenkov, Doctor Sobolevsky and Mr Migachev were 
fabricated and falsely “created” into the Moscow LIMS 
on or after 25 November 2018. 


In addition, Forum Messages’ evidencing the 
involvement of then Moscow Laboratory head of the 
Sample Reception and Aliquoting Department, Evgeny 
Kudryavtsev (Mr Kudryavtsev), in sample swapping, 
analysis of “pre-departure”’ samples and falsification of 
Laboratory chain-of-custody records were deleted from 
the Moscow LIMS on or after 25 November 2018. 
Notably, Mr Kudryavtsev’s sample swapping and record 
falsification activities immediately preceded WADA’s 17 
December 2014 attendance at the Moscow Laboratory 
to seize and remove 4,144 samples. 


The significance of deleting these Forum Messages is 
best realised by the fact that Mr Kudryavtsev was 
named by Doctor Rodchenkov as being intimately 
involved in sample swapping at the Sochi Olympic 
Games (Sochi Games). Moreover, during subsequent 
CAS® proceedings, Mr Kudryavtsev has vigorously 
disputed Doctor Rodchenkov's claims and stated that he 
wanted to prove to the world that Doctor Rodchenkov 
was lying and there was no sample swapping at the 
Sochi Games. 


Scenario of Events 


Based on confirmed facts, evaluative interpretation of 
forensic findings and the Russia Forensic Investigation, 
the Intelligence and _ Investigations Department 
proposes the following scenario of events as 
contextualising and evidencing the manipulation of the 
Moscow Data: 


On 29 November 2013, Mr Kudryavtsev sent a Forum 
Message to a colleague advising that there were 15 


® The Moscow LIMS is the forensic copy of the Moscow Laboratory 
LIMS imaged by WADA on 12 January 2019. 


” Doctor Rodchenkov asserted the existence of “pre-departure” 
testing of Russia athletes whereby select Russian athletes would be 
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“pre-departure” samples requiring analysis. 
Predeparture testing was the unofficial analysis of 
samples from select Russian athletes prior to 
competition to ensure their use of Prohibited 
Substances was not detectable. Mr Kudryavtsev also 
directed the colleague to falsify Laboratory chain-of- 
custody (CoC) records. 


Between February 2014 and July 2016, LIMS database 
backups were generated on the “primary” disk of the 
LIMS server (Imaged Primary Disk), in a specific 
directory (Directory). Notably, the LIMS system had 
been configured to extract and store daily automated 
databases backups (Automated Backups). Backups of 
the LIMS system are valuable as they provide a 
reference point of comparison to identify altered or 
missing data from the Moscow Data. The absence of 
backups is considered suspicious. 


On 3 December 2014, the German television channel 
ARD_ aired a documentary (ARD Documentary) 
alleging the existence of state-sponsored doping 
(Protection Scheme) in Russia. 


On 9 December 2014, WADA, by letter, directed the 
Moscow Laboratory (i.e. Doctor Rodchenkov) to retain 
all samples until further notice by WADA. 


On 10 December 2014, WADA launched an 
Independent Commission (IC) to investigate the ARD 
Documentary allegations. 


On 11 December 2014, Doctor Rodchenkov was 
advised by the Russian Ministry of Sport that WADA 
staff had applied for visas to Russia. Expecting an 
imminent visit by WADA and the seizure of samples, 
Doctor Rodchenkov discarded samples, swapped 
samples and falsified CoC records. 


On 15 December 2014, Mr Kudryavtsev received a 
Forum Message containing several sample (Laboratory) 
codes from Mr Migachev. Mr Kudryavtsev replied asking 
if these samples were apart from the “21 substituted 
samples, or [was] it absolutely everything that had to be 
removed?” 


In this context the term “substituted samples” denotes 
the practice of sample swapping, whereby the contents 
of a “dirty” sample is replaced with urine clear of 
Prohibited Substances. 


unofficially tested prior to competition to ensure their use of 
Prohibited Substances was not detectable. 


8 Court of Arbitration for Sport; For example: CAS 2017/A/5379 
Alexander Legkov v. International Olympic Committee (IOC), [352]. 
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On 16 December 2014, Mr Kudryavtsev asked Mr 
Migachev via a Forum Message to falsify CoC records. 


On 16 December 2014, WADA announced details of the 
three-person IC. 


On 17 December 2014, WADA attended the Moscow 
Laboratory to secure and remove all samples stored in 
the facility. 


On 9 November 2015, WADA received the IC’s Report 
Part One. 


On 17 November 2015, Doctor Rodchenkov fled Russia 
for the United States. 


On 18 November 2015, the Russian Anti-Doping 
Agency (RUSADA) was declared non-compliant. 


On 14 January 2016, WADA received the IC’s Report 
Part Two. 


On or before 22 January 2016, “a” mounted “secondary” 
disk existed in the LIMS server.° 


On 15 April 2016, WADA revoked the accreditation of 
the Moscow Laboratory. 


On 19 May 2016, WADA announces the Independent 
Person (IP) Commission. 


On 9 June 2016, the Moscow LIMS was _ remotely 
accessed for the last time. 


On 29 June 2016, the backups of the Moscow LIMS 
created in 2014 and 2015 were deleted from the Imaged 
Primary Disk. 


On 18 July 2016, WADA received the IP’s Report Part 
One. 


On 19 July 2016, the International Olympic Committee 
(l1OC) announce the “Schmid” Commission. 


On 21 July 2016, the Investigative Committee entered 
the Moscow Laboratory to secure evidence in their 
investigation of Doctor Rodchenkov. 


Between 21 July 2016 and 25 July 2016, a vast number 
of files, including Raw Data files, were deleted from 12 
instrument computers and the Imaged Primary Disk. 


On 2 August 2016, the Automated Backup script was 
run on the Imaged Primary Disk. However, Independent 
Experts cannot determine whether it continued to run on 
the Imaged Primary Disk or was subsequently run on a 
“secondary” disk. 


® Mounting a hard disk makes it accessible by the computer. This is a 
software process that enables the operating system to read and write 
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Notably, database backup files generated between 
August 2016 and 17 December 2018 by the Automated 
Backup script do not exist on either the Imaged Primary 
Disk or the secondary disk as imaged by WADA 
(Imaged Secondary Disk). This absence is suspicious. 


On 9 December 2016, WADA received the IP’s Report 
Part Two. Accompanying this report was a release of the 
non-confidential evidence (Evidence Disclosure 
Package (EDP)). EDP’s were publicly available via a 
website. 


On 2 April 2017, “a” mounted secondary disk existed in 
the LIMS system. However, Independent Experts 
cannot state, based on observable forensic evidence, 
that this secondary disk was the same secondary disk 
observed in the system on 22 January 2016 or the 
Imaged Secondary Disk. 


On 20 September 2018, the importance and intended 
purpose of the Moscow Data became known to Russian 
authorities with the introduction of the Reinstatement 
Conditions. 


On 16 October 2018, WADA advised Minister Kolobkov, 
via letter, that the Moscow Data was sought solely to 
identify those athletes who may have committed anti- 
doping rule violations. 


On or after 20 November 2018 but before 23 December 
2018, logs from the Moscow LIMS “/og_do” table from 
the years 2012, 2013 and 2014 were deleted. 


The “/log_do” table housed data files (Logs) that record 
events and a user’s actions in a computer operating 
system (i.e. Moscow LIMS). 


On or after 23 November 2018 but before 23 December 
2018, logs from the Moscow LIMS “log do” table for 
2015 were deleted. 


On or after 25 November 2018, select Forum Messages 
were fabricated, modified and deleted in the LIMS 
system by an “unknown” person. 


On 27 November 2018, WADA arrived in Moscow to 
discuss operational issues related to retrieving the 
Moscow Data. 


On 15 December 2018, “a” mounted secondary disk 
existed in the LIMS system. However, as previously 
stated, Independent Experts cannot state, based on 
observable forensic evidence, that this secondary disk 
was the same secondary disk observed in the system 
on 22 January 2016 or 2 April 2017. 


data to the disk. Most disks are automatically mounted by the 
operating system when they are connected. 
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On 17 December 2018, late in the afternoon, WADA 
arrived in Moscow to obtain a forensic copy of the 
Moscow Data. No data would be copied on this 
occasion. 


On 17 December 2018, “a” secondary disk existed in the 
LIMS system. This disk (i.e. Imaged Secondary Disk) 
was ultimately forensically imaged by WADA. Notably, 
Russian Experts assert the Imaged Secondary Disk was 
first introduced to the LIMS system on this day. 
However, because of actions undertaken within the 
system on 17 December 2018, Independent Experts 
cannot state that the Imaged Secondary Disk was the 
same secondary disk observed in the system on 22 
January 2016, 2 April 2017 or 15 December 2018. 


On 17 December 2018, the following events occurred 
in the Moscow Laboratory: 


(a) The system administrator, Evgeniy Mochalov 
(System Administrator), backdated the LIMS 
system to 12 November 2015 — a date five days 
before Doctor Rodchenkov fled to the United 
States. Alterations were then made to the LIMS 
database, including file deletion and creation of 
files under directories related to databases 
labelled “2012”, “2013, “2014”, “2015” and 
“forum_t”.1° 


(b) Evidence of these activities in logs generated by 
Automated Backup (daily) processes were 
selectively deleted. In addition, Logs showing 
backdating to 12 November 2015 were 
subsequently selectively deleted. 


(c) Over 450 database backups of the Moscow LIMS 
database created in 2016 were deleted from the 
Imaged Primary Disk. 


Notably, the Russia Forensic Investigation 
asserts that the System Administrator deleted 
these backups after he copied them to his 
working computer to free up space on the Imaged 
Primary Disk. However, Independent Experts 
established that the Imaged Primary Disk had 
approximately 93% of “free space” available, 
more than enough for LIMS operations. In other 
words, files did not need to be moved as enough 
free space already existed on the disk. 


Additionally, Independent Experts did not find the 
“copied” backups in the New Data, despite the 
New Data purportedly containing a forensic copy 
of the System Administrator's computer. 


10 Table “forum_t’ is the Forum Message table. 
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(d) Acommand (Zeroing Command) was executed 
on the Imaged Primary Disk for anywhere up to 
170 minutes. This command overwrites the free 
space of a disk with zeroes and renders 
unrecoverable all traces of prior commands, 
activities or previously deleted data. In other 
words, potentially a substantial amount of data. 


(e) A specific command was then executed which 
irretrievably deleted information as to the precise 
number of zeros written on the Imaged Primary 
Disk and the exact length of time the Zeroing 
Command operated. 


(f) The system date was then returned to 17 
December 2018. 


(g) The LIMS system was then backdated to 11 
August 2015 - a time when Doctor Rodchenkov 
was still Director of the Laboratory. 


(h) Whilst the system was backdated, the Imaged 
Secondary Disk was formatted so that it now 
falsely appeared to have been formatted on 11 
August 2015. 


Formatting sets up the file system and cleans all 
references to existing and already allocated files. 
Formatting does not overwrite a disk with zeros. 
However, at the time of formatting the Imaged 
Secondary Disk contained no data, only zeros. 
While executing a Zeroing Command on the 
Imaged Secondary Disk would explain the zeros, 
Independent Experts could not find observable 
forensic evidence of this occurrence. 


(i) | After formatting, the Imaged Secondary Disk was 
never remounted or used to store data. 


(j) The commands to overwrite free space with 
zeros, backdate the LIMS system and format the 
Imaged Secondary Disk were selectively deleted 
from the history files (Command Logs). 


Command Logs are a means for identifying 
commands executed on a system, including 
modifications to the system and a database. The 
effect of deleting Command Logs is that the 
associated actions (zeroing, backdating and 
formatting) are invisible without digital forensic 
analysis. 


On 8 January 2019, the System Administrator executed 
a script containing commands that backdated the LIMS 
system to 23 May 2015 and then: 
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(a) replaced the LIMS database with a prior version 
(Prior Version); 


(b) deleted 632 LIMS database files (e.g. OPT, MYD, 
MYI and FRM);*4 


(c) backdated the timestamps of all database files. 


(d) The System Administrator then used automated 
scripts to alter the LIMS database and backdate 
multiple databases and associated files to 
various dates. 


(e) The System Administrator then deleted scripts 
designed to alter and backdate the LIMS 
database. 


The effect of these actions is that Prior Version now 
falsely appeared to have been on the LIMS system 
since 23 May 2015. 


An attempt was then made to restore the LIMS system 
back to the correct date of 8 January 2019, however, 
the System Administrator erroneously set the date to 1 
August 2019. The system then remained on 1 August 
2019 until it autocorrected at 03:05 hours (3:05AM) and 
reverted to the true date. 


Analysis subsequently identified three instances where 
the digital forensic evidence shows that between 6 
January 2019 and 9 January 2019, LIMS data indicative 
of doping was manipulated and or deleted to the 
betterment of the athletes (i.e. concealment of potential 
doping) in relation to three athletes, including one from 
the Target Group. 


Between 1 January 2019 and 9 January 2019 
(inclusively), 19,982 files and folders were deleted from 
the LIMS server, computer instruments and associated 
recycle bins,** including 11,720 “SLD”? (Sequence) 
files, 531 PDFs and 337 Raw Data files. Of which, when 
considering files that were not in the recycle bin, 
9,298 Sequence files, 500 PDFs and 1 Raw Data file 
had a creation timestamp between 1 January 2012 and 
31 December 2015. In other words, material analytical 
files created within the relevant LIMS period were 
deleted. 


41 “OPT” files contain database characteristics and are updated every 
time a database is altered. “FRM” files describe a database tables 
format and structure. “MY1” files contain the index files of a database. 
“MYD” files contain data. When a LIMS MySQL database is used, all 
the database related data and metadata are stored in a folder with 
these files in it. These files are used for backup purpose for securing 
schema, data, and indexes, for migration or upgrade of the 
database. 


#2 Recycle Bin: is a location where deleted files or folders are 
temporarily stored. 
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On 9 January 2019, WADA arrived in Moscow to obtain 
a forensic copy of the Moscow Data. WADA did not 
enter the Laboratory until the following day (10 January 
2019). 


On 9 January 2019, the following events occurred in the 
Moscow Laboratory: 


(a) The 2008, 2009, 2010 and 2011 LIMS databases 
were deleted from the Moscow LIMS database. 


(b) The Forum Message table (containing the 
fabricated and modified messages, and absent 
the deleted messages) was restored onto the 
LIMS database. 4 


On 10 January 2019, the following events occurred in 
the Moscow Laboratory: 


(a) 101 Sequence files and 137 PDFs were deleted 
from The Primary Disk. 


(b) late morning, WADA entered the Moscow 
Laboratory and inspected the _ specialised 
equipment to be used to forensically image the 
Moscow Data. 


On 11 January 2019, WADA commenced forensically 
imaging of the Moscow Data, beginning with the ICR 
Disks. 


On 14 January 2019, following a request by Russian 
Experts, WADA allowed the System Administrator to 
backup Server One to a new server to protect against 
data loss during forensic imaging of Server One.15 


On 16 January 2019, the following events occurred in 
the Moscow Laboratory: 


(a) Server ONE was backdated to 19 August 2015 
and a_ system administrator? executed 
commands to format a secondary disk, making it 
appear that the disk was formatted on 19 August 
2015. 


(b) Acommand was executed to overwrite the “free 
space” of the primary disk in Server ONE with 
zeroes. 


8 Analytical Sequence files. 


14 This event undoubtedly occurred between 5 January 2019 and 10 
January 2019, Independent Experts believe the 9 January 2019 to 
be the more likely date. 


45 Russian Experts were concerned that Server One may not restart 
after forensic imaging due to its been an old server. 


16 Whilst this is suspected to have been Mr Mochaloy, to date, this 
has not been acknowledged by Russian authorities. 
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(c) In addition, Server ONE contains digital traces 
compatible with a specialized tool being used to 
secure erase files on 16 January 2019. 


(d) Asystem administrator selectively removed from 
Command Logs on Server ONE that overwrite 
areas of a disk with zeroes and run a specialized 
tool to secure erase files. As stated, overwriting 
the free space of a disk with zeroes renders 
unrecoverable all traces of prior commands, 
activities or previously deleted data. 


On 16 January 2019, after these activities by the system 
administrator, WADA were advised that the backup of 
Server One was complete and could now forensically 
image Server One. 


On 17 January 2019, WADA departed Moscow with a 
forensic image of the Moscow Data. 


ICR Disks 


In short, Independent Experts concluded there was 
insufficient information to verify that the ICR Disks were 
created on the dates nominated by their respective 
timestamps namely, 6 July 2016 (ICR-1), 5 July 2016 
(ICR-2) and 14 August 2015 (ICR-3). That said, no 
activities or alterations were observed on the ICR Disks 
after 6 July 2016. 


There is insufficient information to verify the Russian 
Expert claim that the ICR Disks were created using 
Server One and the LIMS server or that they (i.e. ICR 
Disks) were either currently or previously in use by 
Server One and the LIMS server. 


However, the suggestion that the ICR Disks were either 
currently or previously in use in Server One and the 
LIMS server does not explain the fact that all the 
activities have creation timestamps on a single day. 


The estimated 110 Raw Data and 120 PDF files missing 
from the ICR Disks indicates that data on the ICR Disks 
may not be complete. 


The fact that PDF files are only found in deleted state in 
free space on Disk ICR-2 raises questions about the 
integrity and completeness of data on the ICR-2 Disk. 


The fact that PDF files found only in deleted state in free 
space on Disk ICR-2 contain incongruities that indicate 
their content was altered after the original file creation, 
raises questions about the integrity and completeness 
of data on the Disk ICR-2. 


Files found in deleted state in free space do not have 
any associated file system metadata and, therefore, it 
cannot be stated when they were copied or deleted on 
the disk. 


INTELLIGENCE AND INVESTIGATIONS DEPARTMENT 


Expert Meeting 


During the expert meeting, Russian Experts did not 
provide evidence or further technical material which 
required the Independent Experts to revisit their 
reported findings. 


Minister Kolobkov has personally undertaken to ensure 
Russian Experts investigate the fabricated, modified 
and deleted Forum Messages as well as the instances 
of deleted and manipulated LIMS data between 6 and 9 
January 2019. 


Impact 
Raw Data and PDFs 


There are 110 Raw Data files and 120 PDFs absent 
from the Moscow Data that are material to the 
investigation of Target Group athletes. 


The absence of Raw Data and PDF files appears 
targeted and has materially affected the ability to 
pursue ADRVs against the respective athletes. 


Minister Kolobkov has personally undertaken to ensure 
all possible efforts are made to locate and recover all 
absent Raw Data files. 


To date, 9 Initial Testing Procedure (ITP) Raw Data files 
have been identified which are suspected to have been 
manipulated. 


Independent Experts observed no digital trace of 
manipulation in the 9 ITP Raw Data files. 


Manipulation of Raw Data appears restricted to ITP 
Raw Data. 


Raw Data manipulation appears restricted to instances 
where there is a discrepancy between the WADA LIMS 
and Moscow LIMS. 


ThermoFisher continue to investigate the ability to 
identify digital trace evidence of Raw Data file 
manipulation. 


Doping Violations 


To date, the Intelligence and Investigations Department 
has identified and forwarded prospective ADRV cases 
to the International Weightlifting Federation (IWF) (41 
athletes), United World Wrestling (1 athlete), World 
Taekwondo (2 athletes) and the International Canoe 
Federation (ICF) (1 athlete). 


Of the 41 cases provided to the IWF, 12 athletes have 
been “notified” of ADRV proceedings and provisionally 
suspended. Notably, upon review of the case, the ICF 
has declined to purse an ADRV against the athlete. 
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The Intelligence and Investigations Department has 
also provided the International Association of Athletics 
Federations (IAAF) with the data of all IAAF athletes, 
including that of the 66 IAAF athletes included in the 
Target Pool. 


Two cases have also been commenced by the 
International Biathlon Union (IBU) against two athletes 
outside of the Target Group.’’ The Intelligence and 
Investigations Department are assisting the IBU in this 
regard. 


The targeted reanalysis of samples retrieved from the 
Moscow Laboratory as part of the Reinstatement 
Conditions has, to date, resulted in 14 Adverse 
Analytical Findings (AAFs) from 94 samples 
reanalysed. The 14 AAFs come from three International 
Federations. Results Management of the 14 AAFs is 
being undertaken by RUSADA with the close 
assistance of the Intelligence and Investigations 
Department. 


Conclusion 


Taken in its totality, the above evidence is capable of 
establishing, to the required standard of proof, that the 
Moscow Data was intentionally altered prior and during 
to it being forensically copied by WADA. To this end, 
the Reinstatement Conditions are not fulfilled in that the 
Moscow Data is neither a complete nor authentic copy. 


KkKKK 


1” These two cases have discrepancies between the 2015 LIMS and 
2019 LIMS. 
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3 EVENT CHARTS 


The following are a pictorial representation of key events associated with data manipulation. 


The remainder of this page has been intentionally left blank. 
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4 KEY EVENTS 


On 18 November 2015, the Russian Anti-Doping 


Agency (RUSADA) was declared “non-compliant”. 


On 30 October 2017, the Intelligence and Investigations 
Department obtained the “WADA LIMS”.1® 


On 12 June 2018,*° Russian Minister for Sport, Pavel 
Kolobkov (Minister Kolobkov), informed WADA that 
the “Moscow Data’*° and “Moscow Samples” were 
controlled by the Investigative Committee of Russia 
(Investigative Committee) and, therefore, 
inaccessible. 


On 13 September 2018,2! Minister Kolobkov publicly 
acknowledged that “a number of individuals within the 
[Russian] Ministry of Sport (Ministry) and _ its 
subordinate entities, such as [the] Moscow and Sochi 
Laboratories” were involved in the manipulation of the 
anti-doping system in Russia. 


On 20 September 2018, RUSADA was declared 
“compliant” subject to the production of the Moscow 
Data and the Moscow Samples (Reinstatement 
Conditions). 


On 25 September 2018, the World Anti-Doping Agency 
(WADA) instructed the Compliance Review Committee 
(CRC) to monitor Russia’s?* compliance with the 
Reinstatement Conditions. Instances of non-compliance 
were to be reported. 


On 15 November 2018, WADA proposed to Minister 
Kolobkov to hold a meeting in Moscow on 27 November 
2018 to arrange the practicalities of obtaining the 
Moscow Data (Data Retrieval Mission). 


On 19 November 2018, Minister Kolobkov confirms in 
a letter to WADA the meeting. 


On 27 November 2018, WADA’s “independent Expert 
Team” arrived in Moscow to discuss the operational 
issues of the Data Retrieval Mission. In a subsequent 
meeting, the Independent Expert Team was advised 
that the Moscow Data was controlled by the 


18 Samples analyzed by the Moscow Laboratory between 1 January 
2012 and 31 August 2015. 


1° Letter from Russian Minister for Sport, Pavel Kolobkov (“Minister 
Kolobkov’), dated 12 June 2018. 


20 The “Moscow Data” is comprised of two LIMS hard-drives (a 
“primary” and “secondary”); three hard-drives (ICR-1 [Serial No.: 
WD30EZRX], ICR-2 [Serial No.: WCC4N76LOUAY] and ICR-3 [Serial 
No.: S1Z042P4]) removed from the Laboratory’s file server in the 
instrument room by the Investigative Committee on 21 July 2016; 
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Investigative Committee and Russian law prohibited its 
removal from Russia. 


On 28 November 2018, the Independent Expert Team 
left Moscow. 


On 17 December 2018, WADA representatives (Data 
Retrieval Team) arrived in Moscow to obtain the 
Moscow Data. Conditions imposed by the Investigative 
Committee for obtaining the Moscow Data were 
forensically unsound and contrary to the Reinstatement 
Conditions. Consequently, the Moscow Data was not 
collected. 


On 20 December 2018, the Data Retrieval Team visited 
the Moscow Laboratory and inspected the Moscow Data 
“hardware” (e.g. instrument computers, servers), under 
the supervision of the Investigative Committee. 


On 21 December 2018, the Data Retrieval Team left 
Moscow. 


On 25 December 2018, the “/ndependent Expert’?? of 
the Data Retrieval Team published a report to the CRC 
on the failed data retrieval mission. 


On 9 January 2019, the Data Retrieval Team returned 
to Moscow to collect the Moscow Data. 


On 10 January 2019, the Data Retrieval Team entered 
the Moscow Laboratory and commenced forensic 
imaging of the Moscow Data, under the supervision of 
the Investigative Committee. 


On 14 January 2019, following a request by Russian 
Experts, WADA agreed to allow the System 
Administrator to backup Server One to a new server to 
protect against data loss during forensic imaging of 
Server One.*4 


On 16 January 2019, by the afternoon, the System 
Administrator had completed the backup of Server One 
and WADA commenced forensic imaging of the six 
disks. 


On 17 January 2019, forensic imaging of the Moscow 
Data concluded. The Investigative Committee and the 


Server One (“1”) and its component hard-drives; and 19 instrument 
computers. 


21 Letter from Minister Kolobkov dated 13 September 2018. 


22 In this context, “Russia” means the Russian Anti-Doping Agency 
and the Ministry of Sport for the Russian Federation. 


23 Doctor Jose Antonio Pascual Esteban. 


4 Russian Experts were concerned that Server One may not restart 
after forensic imaging due to its been an old server. 
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Data Retrieval Team received identical copies of the 
Moscow Data. The Data Retrieval Team then left 
Moscow with a copy of the Moscow Data. 


On 17 January 2019, the “Data Retrieval Mission 
Report” was published to the CRC. 


On 14 February 2019, WADA invited Minister Kolobkov 
to Montreal to review the progress of investigations into 
the authenticity of the Moscow Data. 


On 22 March 2019, representatives of Minister 
Kolobkov attended WADA and received a detailed 
briefing of investigations conducted to date. 


On 27 April 2019, Minister Kolobkov advised WADA 
that Russian Experts had completed their analysis 
(Russian Technical Report) of the Moscow Data and 
he proposed to share those results with WADA. WADA 
accepted the offer. 


On 15 May 2019, the “Preliminary Report” was 
published to the CRC. Evidence of data manipulation 
was identified. 


On 20 May 2019, the Preliminary Report was provided 
to Minister Kolobkov. 


On 26 June 2019, the CRC directed investigations be 
conducted into whether RUSADA and the Ministry had 
complied with the Reinstatement Conditions. More 
specifically, the requirement to provide a complete and 
authentic copy of the Moscow Data. 5 


On 27 June 2019, WADA requested Minister Kolobkov 
provide a copy of the Russian Technical Report. 


On 31 July 2019, WADA invited the Minister and 
Investigative Committee to a meeting in Lausanne 
(Switzerland Meeting) to be updated on _ the 
investigation. 


On 31 July 2019, WADA provided the Minister and 
Investigative Committee with a list of 24 questions 
(Authentication Questions) relevant to the 
investigation. A response deadline of 26 August 2019 
was set. 


On 16 August 2019, due to “planned summer holidays” 
the Minister sought an alternate date to the Switzerland 
Meeting. 


25 Compliance Review Committee Minute dated 26 June 2019. This 
document has not been included in this report. 


26 On 5 September 2019. 
27 Attachment B — Russia Statement of Facts. 


8 Attachment A - Digital Forensic Examination Report “PFS 
19.0333”, dated 15 August 2019 (“WADA Technical Report’). This 
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On 19 August 2019, WADA proposed an alternate, but 
earlier meeting date. 


On 26 August 2019, Minister Kolobkov accepted the 
original Switzerland Meeting date. Minister Kolobkov 
answered the Authentication Questions and posed 14 
questions (Russian Questions) on behalf of the 
Russian Experts. Minister Kolobkov also provided a 
statement of general facts (Russia Statement of 
Facts)?’ concerning authentication of the LIMS system. 


On 5 September 2019, the Switzerland Meeting 
occurred. During the meeting, the Russian Questions 
were answered. WADA again requested a copy of the 
Russian Technical Report. 


On 6 September 2019, the “CRC Report’ was 
published to the CRC. This report included a technical 
report (WADA Technical Report) from the Independent 
Experts.?8 In response to the report, the CRC directed 
further specific investigations be conducted by the 
Independent Experts. 


On 9 September 2019, WADA again requested Minister 
Kolobkov provide a copy of the Russian Technical 
Report. 


On 17 September 2019, the CRC Report was provided 
to Minister Kolobkov. The report included a copy of the 
WADA Technical Report and 31 “Technical Questions” 
posed by the Independent Experts to assist their 
investigation of the Moscow Data. 


On 30 September 2019, WADA requested Minister 
Kolobkov provide a copy of the “Russian Technical 
Report”. 


On 8 October 2019, Minister Kolobkov provided a folio 
of technical documents. This folio comprised the 
Russian Technical Report,22 “Counter Research”*° 
conducted by Russian Experts in response to the WADA 
Technical Report and answers to 23 of the 31 Technical 
Questions. 34 


On 11 October 2019, the Intelligence and Investigations 
Department advised the CRC that the Russia Forensic 
Investigation identified, potentially, four additional data 
sources (New Data) relevant to the Reinstatement 
Conditions. The existence of the New Data was not 
previously known to WADA. 


report was previously named “Digital Forensic Report 2” in the CRC 
Report. 


?8 Attachment C (“Russian Technical Report’). 
30 Attachment D (“Counter Research”). 


31 Attachment E (“Attachment E - Answers to Technical Questions”). 
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On 15 October 2019, WADA requested Minister 
Kolobkov immediately procure the New Data and 
produce it to WADA no later than 23 October 2019. 
Minister Kolobkov was also asked to provide a response 
to each of the eight unanswered questions by the same 
date. 


On 22 October 2019, Minister Kolobkov provided 
answers to the eight unanswered _ Technical 
Questions. 32 


On 23 October 2019, the New Data was produced to 
the Intelligence and Investigations Department in 
Geneva, Switzerland. 


On 8 November 2019, Independent Experts produced 
three reports, namely: 


(i) A forensic analysis of content alterations within 
the Moscow Data (WADA Alteration Report); 


(ii) | an evaluative assessment of the Russia Forensic 
Investigation (WADA Evaluation Report);** and 


(iii) © An authentication assessment of the ICR Disks 
(WADA ICR Disk Report).*5 


On 11 November 2019, the Intelligence and 
Investigations Department published a_ preliminary 
report to the CRC primarily detailing the results of the 
Independent Expert evaluation of the Russia Forensic 
investigation. 


On 13 November 2019, Independent Experts produced 
a forensic analysis of the New Data (WADA New Data 
Report).°¢ 


On 14 November 2019, the Intelligence and 
Investigations Department and Independent Experts 
met with Minister Kolobkov and the Russian Experts in 
Lausanne, Switzerland. 


On 15 November 2019, the Intelligence and 
Investigations Department published a report to the 
CRC primarily detailing the results of the Independent 
Expert assessment of the New Data. 


On 17 November 2019, Intelligence and Investigations 
Department investigators attended a meeting of the 
CRC held in Geneva, Switzerland. 


On 19 November 2019, the Intelligence and 
Investigations Department reported the 14 AAFs (from 


52 These have been included in Attachment E. 


33 Attachment H — Forensic Analysis of Content Alterations Report 
“PFS 19.0425” (“WADA Alteration Report’). 


34 See Attachment F - Evaluative Interpretation “PFS 19.0426” 
(‘WADA Evaluation Report’). 
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the Moscow sample reanalysis program) to RUSADA, 
the Results Management Authority. 


On 20 November 2019, the Intelligence and 
Investigations Department published a final report to the 
CRC combining the 11 November 2019 and 15 
November 2019 reports. 


35 See Attachment G — Authentication of ICR Disks “PFS 19.0427” 
(“WADA ICR Disk Report’). 


36 See Attachment I —- WADA New Data Report “PFS 19.0431” 
(‘WADA New Data Report’). 
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5 PURPOSE 


This is the final report to the Compliance Review 
Committee (CRC) regarding the Intelligence and 
Investigations Department investigation of the “Moscow 
Data”.*” More specifically, whether the data provided by 
Russian authorities in response to the “Reinstatement 
Conditions”*® was an authentic copy. °9 


The purpose of this report is fivefold. 


Firstly, detail the result of the WADA Expert assessment 
of the “New Data” received from Russian Minister of 
Sport, Pavel Kolobkov (Minister Kolobkov), on 23 
October 2019. 


Secondly, detail the result of the WADA Independent 
Expert assessment of the “Russia _ Forensic 
Investigation’*° and answers the question whether the 
Russia Forensic Investigation disturbs the findings of 
the WADA Technical Report. 


Thirdly, detail the result of investigations conducted into 
the forensic veracity of three disks (ICR Disks) 
purportedly seized from the Moscow Laboratory by the 
Investigative Committee on 21 July 2016. 


Fourthly, detail the result of the meeting between the 
Independent Experts and Russian Experts held in 
Lausanne, Switzerland on 14 November 2019. 


Lastly, report the impact of the data manipulation and 
deletion, more specifically missing Raw Data files, on 
the ability to conduct complete and_ thorough 
investigation of “Target Group”“: athletes. 


6 OVERVIEW 


The Report is organized as follows. 


In Part Seven (“Scope”), the report details the scope of 
this investigation as mandated by the CRC. 


In Part Eight (“Standard of Proof”), the report details 
the standard of proof applied by the Intelligence and 
Investigations Department in the assessment and 


3” Moscow Data: Moscow Laboratory’s LIMS database covering the 
period 1 January 2012 to 31 August 2015, along with the data 
underlying the findings reported in the LIMS database for that period. 
The Moscow Data comprises all the Moscow Laboratory servers and 
computer instruments that were forensically imaged by WADA as 
part of the Reinstatement Conditions. 


38 On 20 September 2018 the WADA Executive Committee 
reinstated the Russian Anti-Doping agency (“RUSADA’) to the list of 
Code-compliant Signatories, on condition that RUSADA and the 
Ministry ‘must procure’ the provision to WADA by 31 December 2018 
of the Moscow Data. 
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establishment of the relevant facts namely, “comfortable 
satisfaction’, having in mind the seriousness of the 
allegations. 


In Part Nine (‘Due Process”), the report details the 
process of engagement and fairness afforded to Ministry 
and the Investigative Committee (collectively, “Russia”) 
throughout the entire investigation. 


In Part Ten (“Background”), the report provides an 
overview of the Russia Forensic Investigation. 


In Part Eleven, (“Analysis”), the report details the 
results of the analysis conducted of the Russia Forensic 
Investigation by the Independent Experts. 


In Part Twelve, (“ICR Disks”), the report details the 
results of investigations conducted into the forensic 
veracity of the three disks purportedly seized by the 
Investigative Committee from the Moscow Laboratory 
on 21 July 2016. 


In Part Thirteen (“Forum Messages’), the report details 
the results of investigations conducted in the messages 
exchanged within the LIMS system by Laboratory staff 
at material times. 


In Part Fourteen (“Fabricated Evidence’), the report 
details evidence that select Forum Messages have been 
fabricated, altered and deleted prior to WADA obtaining 
a forensic copy the Moscow Data. 


In Part Fifteen (‘New Data’), the report details the 
Independent Expert assessment of the New Data. 


In Part Sixteen (“Expert Meeting”), the report details the 
result of a meeting between Minister Kolobkov, Russian 
Experts and the Independent Experts held in Lausanne, 
Switzerland on 14 November 2019. 


In Part Seventeen (“Impact”) the report details the 
impact of data manipulation and deletion, more 
specifically missing Raw Data files, on the ability to 
conduct complete and thorough investigation of Target 
Group athletes. 


In Part Eighteen (“Conclusion”), the report provides a 
comprehensive conclusion detailing the results of 


3° This report is to be read in conjunction with the “Preliminary 
Report” and “CRC Report” published to the CRC on 15 May 2019 
and 6 September 2019, respectively. 


40 This folio is comprised of Russia Statement of Facts, Russia 
Technical Report, Counter Research and Attachment E - Answers to 
Technical Questions — See Attachments B, C, D and E, respectively. 


41 Target Group: 298 athletes identified as having the most 
suspicious LIMS data based on the WADA LIMS. 
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investigations conducted by the Independent Experts. A 
comprehensive “scenario of events” is also proposed by 
investigators to better contextualise the totality of 
evidence discovered to date. 


In Part Nineteen (“Annexures”), the report provides 
copies of the substantive documents comprising the 
Russia Forensic Investigation and the four reports 
produced by the Independent Experts. 


In Part Twenty (“Terminology”), the report decodes the 
terminology used by the Independent Experts in 
assessing and describing the evidence strength of any 
observed (trace) digital forensic evidence. 


7 SCOPE 


7.1.1 Background 


The CRC is required to evaluate whether RUSADA and 
the Ministry (collectively, “Russia”) has provided an 
“authentic” copy of the Moscow Data. 


On 15 May 2019, the Preliminary Report identified 
evidence of data manipulation. 


On 26 June 2019, the CRC directed investigation of the 
alleged data manipulation. However, “to be efficient as 
possible, and because it may not be necessary to 
expand the scope if the initial results are definitive”, the 
CRC narrowed the initial scope of the investigation 
focusing on events “around” 8 January 2019.42 


On 6 September 2019, the CRC Report identified 
evidence of data manipulation between 17 December 
2018 and 10 January 2019. 


7.1.2 | Mandate 


On 9 September 2019, the CRC directed Independent 
Experts review the Russia Forensic Investigation and 
assess its forensic rigor with a view to identifying those 
aspects which they agree and those which they do not 
agree. The Experts are requested to provide forensic 
evidence in support of their opinions. 


The Independent Experts were also required to assess 
what, if any impact, the Russia Forensic Investigation 
has on their own forensic findings (WADA Technical 
Report). 


42 Compliance Review Committee Minute dated 26 June 2019. This 
document has not been included in this report. 


INTELLIGENCE AND INVESTIGATIONS DEPARTMENT 


8 STANDARD OF PROOF 


In the event of a dispute, the allegation of non- 
compliance will be determined by the Court of 
Arbitration for Sport (CAS). 


The standard of proof applicable in any CAS proceeding 
is one of “comfortable satisfaction’. Accordingly, the 
Intelligence and Investigations Department has adopted 
this standard in its assessment of evidence in this case. 


As detailed in the CRC Report, Independent Experts 
were previously provided with an explanatory note 
detailing the meaning and. application of the 
“comfortable satisfaction’ standard of proof prior to the 
finalization of their report. 


9 DUE PROCESS 


As outlined above (see Part 4, “Key Events”), this 
investigation has continued to be conducted fairly and in 
accordance with the principles of natural justice and due 
process. 


10 BACKGROUND 


This is a highly protracted and complex investigation. 
Comprehension is assisted by first providing a general 
overview of the findings of the Intelligence and 
Investigations Department investigation as reported to 
the CRC on 6 September 2019 (CRC Report) and the 
Russia Forensic Investigation. This report then details 
the results of the Independent Experts’ in-depth 
evaluation of the Russia Forensic Investigation (see 
Part 10, “Analysis”). 


In short, the purpose of the evaluation was to see if the 
Russia Forensic Investigation disturbed the findings of 
the Independent Experts as detailed in WADA Technical 
Report. 42 


10.1 WADA INVESTIGATION 


On 6 September 2019, the Intelligence and 


Investigations Department advised the CRC that, for the 
following reasons, the Moscow Data was neither 
complete nor authentic. 


First, on 17 December 2018, “a” “secondary” disk 
connected to the LIMS computer was formatted while 


43 Attachment A — WADA Technical Report. 
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the system was backdated, thereby making it appear the 
formatting occurred on 11 August 2015. 


Second, on 17 December 2018, over 450 database 
backups of the Moscow LIMS database created in 2016 
were deleted from the LIMS server. 


Third, on 6 January 2019, 10,565 files and folders were 
deleted from the Moscow Laboratory computers 
including, 7,309 “sequence” files, 336 Raw Data files 
and 187 PDFs.“ *° These types of files contain the most 
relevant anti-doping data. Notably, Independent Experts 
have since reviewed these figures and now assert that 
15,325 files and folders were deleted on 6 January 2019 
from the Moscow Laboratory servers and instrument 
computers. They include 11,720 “sequence” files, 337 
Raw Data files and 531 PDFs. 


Fourth, recovered “back-up” versions of LIMS database 
contain case relevant records that were deleted after 6 
January 2019 but before 9 January 2019. 


Fifth, on 8 January 2019, data in LIMS database, were 
deleted while the LIMS system was backdated, thereby 
making it appear the deletions occurred on 23 May 
2015. A total of 623 files from 9 folders*® were deleted 
on this occasion. 


Sixth, automated scripts were discovered on the LIMS 
“primary” disk which were designed to alter the time and 
date of the LIMS system before data was imported into 
the LIMS database, thereby making it appear the data 
updates had occurred on earlier dates. 


Seventh, on 9 January 2019 (most likely at 9:10PM), 
the 2008, 2009, 2010 and 2011 LIMS databases were 
“removed” from the LIMS database. 


Eighth, on 10 January 2019, 101 “SLD” (Sequence) 
files and 137 PDFs were deleted from The Primary 
Disk.*” 


Ninth, log files show connections to the LIMS system 
from IP address 192.168.0.19 around the times the data 
alterations and deletions were made in January 2019. 
This IP address appears most often assigned to a 
computer from which the user authenticates on the 
LIMS website as “evgeniy.mochalov’. Evgeniy 
Mochalov (Mr Mochalov) is the IT manager of the 


4 Following the completion of the analysis of a sample aliquot, an 
Initial Testing Raw Data file is created by the analytical instrument. A 
PDF is then generated from the Raw Data. A PDF contains 
information such as the Raw Data and Instrument Computer names 
as well as the operator and the date of analysis. More importantly, the 
PDF indicates whether prohibited substances were detected in the 
sample aliquot. 


45 Attachment A — WADA Technical Report, (Appendix 
File_deleted_timestamp). 
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Moscow Laboratory since October 2016 and the 
husband of the current Moscow Laboratory “/nterim” 
Director, Elena Mochalova (Director Mochalova). Mr 
Mochalov was heavily involved in retrieval of data by the 
Independent Experts in January 2019. 


Tenth, on the systems examined, no traces of remote 
access (meaning from outside the local network) were 
found, generally, and more specifically during the time 
when the alterations were made in January 2019. 


10.2 RUSSIA INVESTIGATION 


On 8 October 2019, in response to the CRC Report, 


Russian authorities provided a folio of technical material 
(“Russia Forensic Investigation”) countering any 
suggestion of data manipulation. The folio revealed the 
existence of New Data. 


On 23 October 2019, the New Data was produced to the 
Intelligence and Investigations Department in Geneva, 
Switzerland. 


10.2.1 The Russian Case 


In short, Russian authorities assert compliance with the 
Reinstatement Conditions and deny data manipulation. 
Moreover, the Moscow LIMS has been so contaminated 
with “falsified results” by Doctor Grigory Rodchenkov 
(Doctor Rodchenkov) and others, that it is of no 
evidentiary value and the only reliable evidence is Raw 
Data and samples where such exists. “8 


In asserting this position, the Russian case is argued on 
three fronts. Firstly, the CRC _ investigation was 
incomplete and flawed (The Investigation). Secondly, 
the Moscow LIMS was a broken and antiquated system, 
designed under the supervision of Doctor Rodchenkov 
and others for unlawful financial gain (Criminal 
Enterprise). Lastly, WADA has mistaken human error 
and system malfunction as data manipulation (The 
Circumstances). Each will be examined in turn. 


10.2.2 The Investigation 


Russian authorities criticized the narrow mandate of the 
CRC investigation. More specifically, the focusing on 
events between 17 December 2018 and 10 January 


46 The files were deleted from the folders named “2012”, “2013”, 
“2014”, “2015”, “crm”, “crm_v2”, “forum”, “mysql” and “ref_urine”. 


4” The files were deleted from the folders named “2012”, “2013”, 
“2014”, “2015”, “crm”, “crm_v2”, “forum”, “mysql” and “ref_urine”. 


48 Attachment C - Russian Technical Report (Part 2), pages 59-62. 
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2019. Russia assert this has prevented Independent 
Experts from gaining a complete and true understanding 
of the LIMS system, its anomalies and shortcomings. *? 


Consequently, the work of the Independent Experts is 
not objective, and their findings are improperly “one- 
sided” and incorrect.5° 


Russian authorities also criticized purported 
inconsistencies between the content of the CRC Report 
and the WADA Technical Report.5* 


10.2.3 Criminal Enterprise 


The case for the criminal enterprise and the frailty of the 
LIMS data is premised upon the following five evidential 
pillars. Each will be examined in turn. 


Firstly, the Moscow LIMS was designed by Oleg 
Migachev (Mr Migachev) to further a criminal enterprise 
orchestrated by Doctor Rodchenkov and Doctor 
Timofey Sobolevsky (Doctor Sobolevsky) (System 
Design).52 


The criminal enterprise was the falsification of analysis 
results to coerce money from athletes and coaches. *? 


Second, the Moscow LIMS was designed to allow the 
analysis results of select samples to be “hidden” from 
other users (Restricted Records).5* 


Third, embedded within the LIMS was a “Message 
Exchange Platform” which enabled users to message 
(text) other users within the system. Messages were 
observed which show Doctor Rodchenkov and Doctor 
Sobolevsky discussing their criminal enterprise (Forum 
Messages). °° 


Fourth, the Moscow LIMS system and all associated 
data, including PDFs, could be accessed remotely. 
Moreover, the system was remotely accessed by Doctor 
Sobolevsky and Mr Migachev after their resignations 


48 Attachment D - Attachment D - Counter Research, page 4. 
5° Attachment D - Attachment D - Counter Research, page 2. 
51 Attachment D - Attachment D - Counter Research, page 2. 
52 Attachment C - Russian Technical Report (Part 1), pages 3-4. 
53 Attachment C - Russian Technical Report (Part 1), page 6. 


54 Attachment C - Russian Technical Report (Part 1), pages 4, 19; see 
also Attachment D - Counter Research, page 6. 


55 Attachment C - Russian Technical Report (Part 1), page 6. 
56 Attachment C - Russian Technical Report (Part 1), page 4. 


5” Attachment C - Russian Technical Report (Part 1), page 4; see also 
Russian Technical Report (Part 2), pages 61-62. 
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from the Moscow Laboratory in August 2015 (Remote 
Access). 


Lastly, inconsistency between some Raw Data files and 
their associated PDFs was observed, as was evidence 
of PDF manipulation (Data Manipulation).5” 


10.2.3.1 System Design 


” 


The Moscow LIMS was a “personal initiative 
developed, ostensibly, by Mr Migachev®® under the 
“supervision” of Doctor Rodchenkov.°? 


The LIMS system was “deeply integrated within the 
activity of the Laboratory” and automated actions within 
the Moscow Laboratory for the “reception, registrations 
and analysis of doping samples”.®° 


However, embedded within the system were 
“mechanisms” (automated scripts) designed to 
manipulate information and modify “targeted” PDFs. 
According to Russian Experts, these mechanisms were 
“developed [and] used exclusively” under Doctor 
Rodchenkov’s leadership. ® Moreover, “hard evidence” 
exists that automated deletion programs existed on the 
analytical instrument computers and that these 
programs were used by ‘“staff’ between 2010 and 
2015. 6 


10.2.3.2 Restricted Records 


Access to the LIMS system was restricted to “registered” 
users. Over the life of the system, 107 users have been 
registered. 


A.user’s “rights” within the system (to view data or carry 
out operations) are recorded in the “user-rights” table of 
the database.** Such rights are determined by the 
“system administrator’.© 


Seven past and current users have’ enjoyed 
“comprehensive” or full “administrator rights”, namely: ®° 


58 Mr Migachev is the husband of Doctor Timofey Sobolevsky (“Doctor 
Sobolevsky”). 


5° Attachment C - Russian Technical Report (Part 1), page 3. 
60 Attachment C - Russian Technical Report (Part 1), page 3. 


61 Attachment C - Russian Technical Report (Part 1), page 4; see also 
Russian Technical Report (Part 2), page 62. 


52 Attachment D - Counter Research, page 22. 
63 Attachment C - Russian Technical Report (Part 1), page 12. 
54 See “adc.user’ database. 


65 Attachment C - Russian Technical Report (Part 1), page 12; see 
also Attachment D - Counter Research, page 6. 


86 Attachment C - Russian Technical Report (Part 1), pages 12-13. 
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(i) Doctor Sobolevsky; 

(ii) © Mr Migachev; 

(iii) | Doctor Rodchenkov; 

(iv) | Marina Dikunets;® 

(v) | Grigory Dudko;® 

(vi) | Evgeniy Mochalov;® and 
(vii) Elena Mochalova.’”° 


Mr Mochalov and Director Mochalova are the only 
current users with “comprehensive” rights. Doctor 
Sobolevsky, Mr Migachev, Doctor Rodchenkov and 
Marina Dikunets are no longer employed at the Moscow 
Laboratory. 


Evidence of restricted “records” (Restricted Records) 
within the LIMS was observed. More specifically, data 
within the “found”’! table could be restricted to specific 
users and not visible to “normal” users. ’2 


The “found” table house the result of the Initial Testing 
Procedure (ITP) analysis. 


By entering a value of either “1” or “O” in the “do” column 
of the “founa” table, the System Administrator could 
control whether an analysis result was visible to all users 
(“1”) or, visible to only select users (“0”). 7? 


Restricted Records had the ability to mislead normal 
users. For instance, assuming an ITP reported a 
Presumptive Adverse Analytical Finding (AAF) or 
Atypical Finding ina sample, if this record was restricted 
(“0”), the “found” table would be blank and the “normal” 
user would assume the analysis was ‘negative’ because 
the absence of data within the “found” table is 
interpreted as a negative ITP. 


Russian Experts analyzed the Raw Data and PDF files 
for the Restricted Records and identified those samples 
that were restricted (“hidden”) from the normal user and 
where the Raw Data and PDF files showed the 
presence of a Prohibited Substance. In other words, the 
Raw and PDF files show the presence of Prohibited 


8” Former Director of the Moscow Laboratory who replaced Doctor 
Rodchenkov. 


68 Current IT Manager, Moscow Laboratory. 


6° Current IT Manager and System Administrator for the Moscow 
Laboratory. 


7 Current “Acting” Director of the Moscow Laboratory. 


” The “found” table was called “scr_results” table in 2012. It was 
renamed the “found” table in 2013. 


” Attachment C - Russian Technical Report (Part 1), page 4. 
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Substances as indicated in LIMS but “hidden” to a 
normal user. 


Russian Experts also identified samples that were 
restricted (“hidden”) and the Raw Data showed the 
presence of a Prohibited Substance, but the associated 
PDF file did not. This discovery, for the Russian Experts, 
suggested the PDF had been manipulated to ‘negative’ 
(i.e. no Prohibited Substances present) to corroborate 
the “hidden” nature of the records in LIMS.”4 Within the 
normal practice of the Moscow LIMS, the absence of an 
entry in the “founa” table signaled to a user that the 
analysis was negative. Obviously, no entry in the “found” 
table but a PDF reporting a Presumptive AAF would be 
highly suspicious. 


Notably, Restricted Records were first identified by the 
Intelligence and Investigations Department — in 
November 2017, and their existence communicated to 
the Investigative Committee shortly thereafter in a failed 
attempt to gain their cooperation in pursuing cases of 
doping identified within the LIMS.’” In addition, 
Restricted Records were discussed in an affidavit of 
WADA Senior Investigator Aaron Walker that was 
released to over 60 International Federations on 14 
December 2017. 


Restricted Records were also subject of discussion in 
an affidavit from Doctor Rodchenkov released by the 
Intelligence and Investigations Department to over 40 
International Federations on 14 December 2017. In his 
affidavit Doctor Rodchenkov stated: ’6 


“In order to accurately manage and track Samples that 
were subject of a "SAVE" directive, a hidden section of 
LIMS was created (Hidden LIMS). Access to the Hidden 
LIMS section was restricted and inaccessible to an 
authorized LIMS user. Additionally, only personnel 
involved in the [protection of Russian athletes] knew 
about the existence of Hidden LIMS. | had unrestricted 
access to the Hidden LIMS but did not routinely access 
Hidden LIMS. By having Hidden LIMS access, a user 
could identify those Samples that were subject to the 
Disappearing Positive methodology. For those 
Samples, the original PDF Reports contained in Hidden 


73 Attachment C - Russian Technical Report (Part 1), page 10. 


74 Attachment C - Russian Technical Report (Part 1), pages 21-29 
and Russian Technical Report (Part 2), page 39-59. 


*> The Investigative Committee were provided a case example of a 
female Russian athlete involving Restricted Records. The athlete’s 
name has not been included for privacy reasons. However, it can be 
provided upon request. 


78 See 6 December 2017 affidavit of Doctor Rodchenkov, [75]. This 
document has not been included in this report. It may be provided 
upon request. 


23 


CONFIDENTIAL 


WORLD 
ANTI-DOPING 
AGENCY 


LIMS would provide precise and compelling evidence of 
the methodology and Russia's protection of doped 
Russian Athletes. The original Electronic Data Files 
remain in Russia.” 


10.2.3.3 Forum Messages 


A “Message Exchange Platform” existed within the LIMS 
that allowed text communication (Forum Message) 
between staff. Forum Messages are visible only to the 
involved parties, in other words, the sender and 
recipient. However, the System Administrator can view 
all messages. ’’ Forum Messages are also logged in the 
“log_do” table of the LIMS system. 


The parties to a Forum Message are identified via a 
unique identifier,’”® for example, the “identification” 
numbers of Doctor Rodchenkov, Doctor Sobolevsky 
and Mr Migachev were 20, 1 and 2, respectively. Forum 
Messages are also timestamped, and their content 
stored. ’9 


Following analysis that included “linguistic tests”, a 
“stable group” was_ identified within the Forum 
Messages. This group comprised Doctor Rodchenkov, 
Doctor Sobolevsky and Mr Migachev.®° 


In terms of relevance, the centerpiece were messages 
observed between Doctor Rodchenkov and Doctor 
Sobolevsky which explicitly and openly “discussed the 
matter of [receiving] money from sportspeople and 
trainers for the manipulation” of analysis results.®+ For 
example: ® 


Sender Forum Message 


GR “spoke with HO, 2780034, 2780424, 2780489 


out... Do all the files for the scheme and you'll 
get a bonus” 


TS “Kudryatsev is not giving out the aliquote, he's 
asking for a request! | suggest that we let 
Kudryatsev into our sample scheme. We need to 
explain point blank that we create the 
appearance of dirty samples and sportspeople 
and their trainers give us bonuses. Otherwise he 
will grow suspicious and be unlikely to issue re- 
runs without requests. This work requires 


7” Attachment C - Russian Technical Report (Part 1), page 13; see 
also Counter Research Report, page 7. 


78 The unique identifiers for each staff member was recorded in the 
“adc.user’ database. 


78 Attachment C - Russian Technical Report (Part 1), page 13; see 
also Counter Research Report, page 7. 


8° Attachment C - Russian Technical Report (Part 1), page 13. 
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accuracy. Or tell him to show off and provide the 
aliquotes. | much prefer Option 2)” 


GR “Tim, calm down. I'll talk with them later. 
Everything's good” 


TS “do we have any news on the heavy Katina 
11712? She has str, so much time has 
passed...” 

GR “it's not possible to put it in Adams yet. Just wait 


a little. We have to admit, our Syrtzov all... flat 
and maintenance and dacha...” 


TS “Katina doesn't have any, | took it all. I'll stop by 
when you get back” 


GR “Timothy, | cannot reach you. They are bringing 
3 samples today t/a. collect them and check 
them as soon as possible. The envelope should 
still be there. Don't worry” 


TS “it's totally fucked up there. Oral turinabol, OXA, 
tren. For your examination” 


GR “here you are blockhead” 


Russian authorities assert that these Forum Messages 
evidence both a general scheme of extortion and a 
specific example, namely discussions regarding “Katina 
11712”. 


The Russian Experts assert “Katina” is “probably” 
Russian weightlifter “Ekaterina Katina” (Athlete), the 
number “11712”® is a sample Laboratory Code and the 
letters “str’ denote “steroids”. This sample was also a 
Restricted Record. * 


In the exchange Doctor Rodchenkov tells Doctor 
Sobolevsky not to report the analysis results to ADAMS 
but wait for “payment of some syrtzov”. The phrase “flat 
and maintenance and dacha’” is interpreted as a 
suggestion by Doctor Rodchenkov of how they could 
spend the money namely, the purchase of “properties 
(‘flats”) [to] renovate” .®5 


In the later message Doctor Sobolevsky is said to have 
met with the Athlete, “collected everything” and will stop 
by and see Doctor Rodchenkov when he gets back. In 
the reply message from Doctor Rodchenkov, the 


51 Attachment C - Russian Technical Report (Part 1), pages 6 and 13. 
82 Attachment C - Russian Technical Report (Part 1), page 14. 

83 Sample Code 2946637 collected on 5 September 2014. 

84 Attachment C - Russian Technical Report (Part 2), page 41. 

85 Attachment C - Russian Technical Report (Part 1), page 15. 
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reference to “envelope” is interpreted as an envelope 
containing money. ® 


The “modified PDF” obtained from the LIMS for sample 
11712 did “not show any signs of the presence” of 
Prohibited Substances. ®’ 


The Forum Messages are discussed in detail later in this 
report (see Part 14, “Fabricated Evidence’). 


10.2.3.4 Remote Access 


Evidence of remote access to the LIMS system was 
observed. More specifically, remote access to the “web 
interface” of the LIMS system by Doctor Sobolevsky and 
Mr Migachev.®® 


Once remotely accessed to the system, a user was free 
to access “any information” stored within the LIMS®9 and 
Server “1”.9° Moreover, a “pdf_data’” link existed within 
the “web-server directory’®! that allowed a user to 
remotely access PDFs%? and substitute those files 
(PDFs) with other sample test results. 92 


The last observed instance of remote access was via 
Doctor Sobolevsky’s user account on 9 June 2016. 


10.2.3.5 Data Manipulation 


Examination identified files “presenting characteristic 
signs that testify to the obvious corruption of their 
structure”.°° In detail, a number of PDF files were 
identified with “corrupted internal structure, corrupted 
correlation with the time properties or with various 
contents and concurrent identifiers”. Moreover, some 
PDF files with “various distortions of the text information 
on the test samples” were identified. Finally, 
examination identified inconsistency between analytical 
results reported in some PDFs and those detailed in the 
associated Raw Data files.°° In other words, instances 


86 Attachment C - Russian Technical Report (Part 1), page 16. 
8” Attachment C - Russian Technical Report (Part 2), page 41. 
88 Attachment C - Russian Technical Report (Part 1), page 4. 


8° Attachment C - Russian Technical Report (Part 1), page 9; see also 
Attachment D - Counter Research, page 28. 


8° Attachment D - Counter Research, page 29. 


°1 Observed within the sub-directory structure of disk WD- 
WCCAN76LOUAY. 


82 Attachment C - Russian Technical Report (Part 1), page 11; see 
also Attachment D - Counter Research, page 7. 


88 Attachment D - Counter Research, page 27. 
4 Attachment C - Russian Technical Report (Part 1), page 13. 


85 Attachment C - Russian Technical Report (Part 1), page 5; see also 
Attachment B - Russian Technical Report (Part 2), page 57. 
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were observed where Raw Data files of some samples 
indicated the presence of a Prohibited Substance, but 
the associated PDFs did not. 


Russian Experts “unequivocally” state that the only 
reliable source of information are the Raw Data files. 


10.2.4 The Circumstances 


Fundamental to the Russian case is the claim 
Independent Experts have mistaken system malfunction 
and human error as data manipulation. In support of 
their position, Russian authorities claimed the following: 


(i) Mr Migachev was solely responsible for the 
“maintenance and refinement” of the LIMS 
system.9 


(ii) © Mr Migachev did not produce any manual or 
instructional guide on the LIMS system or its 
“operating algorithms” .% 


(iii) . Subsequent system administrators had to learn 
the LIMS system through trial and error. 


(iv) The Moscow LIMS system was a “crude set of 
programs” with functional abnormalities. *°° 


(v) The server equipment was “aging” and 
“unstable”. +0 


(vi) During Doctor Rodchenkov’s’ tenure, the 
deficiencies and failings of the LIMS system was 
known to but ignored by WADA. 102 


(vii) Instances of file deletion are “inevitable within the 
normal operation of the system”.1°2 


Contextualized by these issues, Russian Expert then 
detailed actions taken by Mr Mochalov in December 
2018 and January 2019 - actions which Independent 
Experts have mistakenly interpreted as _ data 


6 Attachment C - Russian Technical Report (Part 1), page 5; see also 
Russian Technical Report (Part 2), page 57. 


%” Attachment C - Russian Technical Report (Part 1), page 3. 


%8 Attachment C - Russian Technical Report (Part 1), page 3; see 
Attachment D - Counter Research Report, page 13. 


8° Attachment C - Russian Technical Report (Part 1), page 3; see 
Attachment D - Counter Research Report, page 13. 


100 Attachment C - Russian Technical Report (Part 1), pages 4 and 
13. 


101 Attachment D - Counter Research Report, page 13. 
102 Attachment C - Russian Technical Report (Part 2), page 59. 


103 Attachment B - Russia Statement of Facts Annex 1, page 5. 
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manipulation. Such is the importance of these events 
they will be recounted in detail. 


10.2.5 Actions of Mr Mochalov 


On 22 December 2018, Mr Mochalov, as the System 
Administrator, began to prepare the LIMS system for 
2019 (2019 Database) on a “virtual test server’ (Virtual 
Server).?™ The Virtual Server also housed a copy of the 
existing LIMS database. *°5 


Once completed, Mr Mochalov “migrated the [new] 2019 
database from the Virtual Server to the LIMS server’. 
However, during this process Mr Mochalov “erroneously 
saved over” the 2016 LIMS database (2016 
Database). 1° 


To correct his error, Mr Mochalov restored the 2016 
Database using information available on the Virtual 
Server.1°? As a consequence of restoring the 2016 
Database, the LIMS databases from 2008 to 2011 
appeared on the “LIMS server” (from the Virtual 
Server). 1° 


Ordinarily, restorations of this kind were done using pre- 
existing “database backups” saved on “removable 
media” (hardware) kept in the Laboratory’s “accounting 
safe”. However, as it was a Saturday Mr Mochalov was 
alone in the office and could not access to the safe. 1 


On 24 December 2018,11° Mr Mochalov attended the 
office intending to restore the LIMS system to its original 
condition using a database backup ("reserve copy”)*1+ 
created on 21 December 2018 (21 December Backup), 
that had been retrieved from “accounting” safe.12 
However, due to the “urgency” of preparing the 2019 
Database,**? Mr Mochalov postponed this restoration 
until 8 January 2019.14 


On 8 January 2019, Mr Mochalov attempted to restore 
the LIMS system to its original state by using the 21 


104 Attachment E - Answers to Technical Questions, page 19. 
105 Attachment D - Counter Research, page 13. 
106 Attachment D - Counter Research, page 14. 
107 Attachment D - Counter Research, page 14. 


108 This is detailed in the Russia Forensic Investigation video 
(“Russia LIMS Video’) at the 5 minutes and 10 second mark. 


109 Attachment D - Counter Research, page 14. 
10 This was a Monday and a normal business day in Russia. 


111 The database backup was described as a “reserve copy” in the 
Russia LIMS Video, at 5 minutes 10 seconds. 


12 Attachment D - Counter Research, page 15. 


43 Attachment E - Answers to Technical Questions, page 19. 
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December Backup. However, during the restoration the 
LIMS database become “unstable”. Mr Mochalov 
attributed this instability to a “time-date stamp” issue and 
made attempts correct the problem by modifying the 
date and time within the system to 23 May 2015.15 


During the restoration process, Mr Mochalov specifically 
recalled copying the “log_do and /og_error’ tables to a 
“separate backup” because he _ understood the 
importance of these tables. 1*6 


On 9 January 2019, Mr Mochalov attempted to arrest 
the worsening instability within the LIMS system by 
deleting the LIMS server database files before using the 
21 December Backup to restore the databases on the 
Virtual Server.**” During the restoration Mr Mochalov 
added blood analysis data for tests conducted by the 
Laboratory between 21 December 2018 and 9 January 
2019, as well as the “log_do and log_error’ tables from 
the “separate backup”.118 


Ultimately, a “full authentic copy” of the LIMS database 
was recovered to the Virtual Server.119 


Mr Mochalov then deleted all data tables in the 
“War/lib/mysq/LIMS”*° server directory and transferred 
all “correct and necessary database files” from the 
“sqi.tar.qz” archive on the Virtual Server to the main 
LIMS server using “scripts” he had written. 121 


On 9 January 2019 (at 10:50am), Mr Mochalov deleted 
the “doa_bags” and “doa_samples” tables from the 2019 
LIMS database. 122 


The “doa_bags” and “doa_samples” tables related to 
“workplace drug testing” analysis conducted by the 
Moscow Laboratory on behalf of private corporate 
clients. In other words, the tables are not related to 
athletes or anti-doping analysis. 12° 


114 Attachment D - Counter Research, page 15. 
115 Attachment D - Counter Research, page 15. 
46 Attachment D - Counter Research, page 16. 


117 Attachment D - Counter Research, page 16; See also Russia 
LIMS Video, commencing 6 minutes and 30 seconds. 


48 Attachment D - Counter Research, page 16. 
419 Attachment D - Counter Research, page 16. 
120 LIMS Server. 

121 Attachment D - Counter Research, page 16. 
122 Attachment D - Counter Research, page 16. 


123 This information is derived from information provided by a 
whistleblower and corroborative analysis conducted by the 
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10.2.6 Comparison of recovered backups 


Russian Experts conducted a comparative analysis of 
previously deleted, but since restored, database 
backups from 6 January 2019 and 10 January 2019. 
Minor differences were observed, for example, some 
records were present only in the 6 January 2019 
backup, while other records were only present in the 10 
January 2019 backup. +4 


However, Russian Experts assert the “minor” 
differences were not the result of the “deliberate 
distortion fof] the database by the System 
Administrator’, but rather, the differences were a 
consequence of there being two “sources for these 
records [namely], the Test Server and the LIMS 
server’.125 Time zone difference observed in some table 
records supports the proposition that the backups 
occurred on_ different ‘“piece[s] of computer 
equipment” .126 


By way of conclusion, Russian authorities assert the 
totality of this evidence “show that the actions of [Mr 
Mochalov] did not lead to the destruction § or 
modification” of [analysis results] in the LIMS server 
databases”. 12’ 


11 ANALYSIS 


Prior to receiving the Russia Forensic Investigation, 
Independent Experts asserted that based on observable 
digital forensic evidence, the Moscow Data was altered 
before it was forensically imaged (copied) by WADA in 
January 2019.178 These alterations include backdating, 
formatted disk, deleted files and backups, secure 
erased files, selectively removed command _ history 
entries, as well as replaced database, deleted records, 
removed tables and missing logs (collectively, the 
‘WADA Forensic Findings’). 


The following is an evaluation of the WADA Forensic 
Findings in light of the Russia Forensic Investigation. 


Intelligence and Investigations Department of the “doa_bags” and 
“doa_samples” tables. 


124 Attachment D - Counter Research, page 20. 
125 Attachment D - Counter Research, page 20. 
126 Attachment D - Counter Research, page 20. 
127 Attachment D - Counter Research, page 20. 


228 Forensic imaging of the Moscow Data was undertaken by WADA 
from 11 January 2019 to 17 January 2019. 


228 Attachment A - WADA Technical Report, Part 5.1.2, page 9. 
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11.1 BACKUP DELETION 


The WADA Technical Report stated that on 17 


December 2018, over 450 database backups of the 
Moscow LIMS database created in 2016 were deleted 
from the LIMS server. 129 


11.1.1 Russia Forensic Investigation 


Russia Forensic Investigation observed a “script’!°° 
(Backup Script) which created “backups” of the LIMS 
database, as well as web server files, and saved them 
to a directory (Directory). 191.192 


However, the Russia Forensic Investigation asserts 
there was no evidence within the system settings that 
“allowed the [Backup Script] to be carried out’.+%3 


11.1.2 WADA Expert Analysis 


Independent Experts similarly observed the Backup 
Script.1%4 However, the Russia Forensic Investigation 
failed to observe that the Directory contained recovered 
names and timestamps of backup files from 2014, 2015 
and 2016 in deleted state. More specifically, over 1,250 
of the backup files created in 2014 and 2015 have a 
deletion timestamp of 29 June 2016, and over 450 
backup files created in 2016 have a deletion timestamp 
of 17 December 2018 (collectively, the “Deleted 
Backups’). **> 


LIMS database backups are valuable to Independent 
Experts as they provide a reference point to identify 
altered or missing data from the Moscow Data. 


The issue of backup deletion was again raised with 
Russian Experts in subsequent correspondence, '*® to 
this end they replied that Mr Mochalov had “movea” 
these files onto his personal computer to “free some 
space” on the Imaged Primary Disk. 


However, Independent Experts established that the 
Imaged Primary Disk had approximately 93% of “free 
space” available, more than enough for LIMS 
operations. In other words, files did not need to be 


180 Script: “backup_LIMS.sh’. 

481 Directory: “/home/olegmigachev/backup_LIMS’. 

182 Attachment D - Counter Research, pages 11-12. 

483 Attachment D - Counter Research, pages 11-12. 

184 Attachment F - WADA Evaluation Report, Part 5.1, pages 10-11. 
185 Ibid. 


136 The question was repeated in request to answer the eight 
unanswered Technical Questions. 
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moved as enough free space already existed on the 
disk. 18” 


Notably, the New Data provided by Minister Kolobkov 
on 23 October 2019 does not contain files that 
correspond to these deleted backup files created in 
2014, 2015 and 2016.18 


11.1.3 Conclusion 


The original finding by the Independent Experts that, 
“On 17 December 2018, over 450 database backups of 
the Moscow LIMS database created in 2016 were 
deleted from the LIMS server’, remains undisturbed by 
the Russia Forensic Investigation. 


11.2. LIMS SYSTEM DISKS 


The LIMS system was comprised of two disks, the 
“primary” disk (Imaged Primary Disk) and the 
“secondary” disk (Imaged Secondary Disk). Both were 
imaged by WADA. 


The Imaged Primary Disk contained data, the Imaged 
Secondary Disk did not. Each will be examined in turn. 


11.2.1 The Primary Disk 


The substantive issue is whether the Imaged Primary 
Disk is authentic and complete. 


11.2.1.1 Russia Forensic Investigation 
The Russia Forensic Investigation asserts the following: 


(a) On17 December 2018, Mr Mochalov executed a 
command?*9 (Zeroing Command) to perform a 
“record speed check” .140 141 


(b) Mr Mochalov had “movea” files from the Imaged 
Primary Disk onto his personal computer to “free 
some space” on the Imaged Primary Disk. 144 


(c) Mr Mochalov selectively deleted the command to 
perform the Zeroing Command from the 


487 Attachment F - WADA Evaluation Report, Part 5.1, pages 10-11. 
188 Ibid. 

489 Command: “dd if=/dev/zero of=/tmp/1.tmp bs=10240k’". 

140 Attachment E - Answers to Technical Questions, page 12. 


141 A record speed check assesses the speed at which data is written 
onto a disk. 


142 Attachment F - WADA Evaluation Report, Part 5.1, pages 10-11. 


443 Command History allows a user to recall, edit or rerun previous 
commands executed in a system. 


144 Attachment E - Answers to Technical Questions (Question 10), 
page 11. 
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Command History!*? because he wanted “to 
avoid erroneous repetition”, in other words, or 
use of this command. “4 


11.2.1.2_ WADA Expert Analysis 


In exploration of this issue, Independent Experts 
observed digital forensic evidence of the following: 


(i) The LIMS system was configured, since “2 March 
2017’, to perform automatic backup operations 
daily (Daily Backup) to a specific directory.1*° 
However, it is not possible to determine whether 
the backups were stored on the “primary” disk or 
the “secondary” disk. 146 


(it) | The Daily Backups related to PDF files (run at 
4:00AM daily) and the LIMS (run at 12:05AM 
daily). 147 


(iii) | Logs on the LIMS system indicate that the Daily 
Backup ran in December 2018 and January 
2019, as scheduled. 18 


(iv) | Backup files expected to be created by the Daily 
Backup, and therefore observed by the 
Independent Experts, do not exist on the LIMS 
system.149 


(v) On 17 December 2018, the Zeroing Command 
was executed on the Imaged Primary Disk which 
has the effect of overwriting areas of a disk with 
zeros,/5° including the “free space”.5! By 
overwriting the free space with zeros, traces of 
prior commands, activities and previously deleted 
data are rendered unrecoverable, such as the 
files “moved” by Mr Mochalov to “free [up] some 
space” on the disk. *52 


(vi) The Zeroing Command could have potentially run 
for “over two hours and 50 minutes” and 


445 Directory: “/mnt/sdb1”. 

446 Attachment F - WADA Evaluation Report, Part 5.2.2, pages 13-14. 
447 Ibid. 

448 Ibid. 

149 Ibid. 

150 Attachment F - WADA Evaluation Report, Part 5.4.5, page 23-24. 


451 On a disk “free space” is the space allocated for receipt of data 
and includes space on the disk which never held data and space that 
held data that has now been deleted. 


162 Attachment F - WADA Evaluation Report, Part 5.4.5, page 23-24. 
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overwritten “substantial amounts of data” on the 
Imaged Primary Disk”.153 


(vii) It is not possible to determine how many zeros 
were written to the Imaged Primary Disk or the 
length of time the Zeroing Command operated 
because a specific command** was executed 
which rendered recovery of this information 
impossible. 195 


(viii) The Zeroing Command, once completed, reports 
how much “free space” on the disk has been 
overwritten with zeros. 


(ix) The command to execute the Zeroing Command 
was selectively deleted from the “Command 
History” logs (Command Logs).1°6 


The Russia Forensic Investigation did not explain the 
following: 


(i) | Why Mr Mochalov sought to perform a record 
speed check by using the Zeroing Command 
which assures the irretrievable deletion of data. 


11.2.2 Conclusion 
The original findings by the Independent Experts that: 


On 17 December 2018, a command was executed to 
overwrite free space of Imaged Primary Disk in the 
LIMS system with zeroes; and 


The System Administrator — now known to be Mr 
Mochalov - selectively removed from history files the 
commands that overwrite areas of the Imaged Primary 
Disk in the LIMS system with zeroes, 


is not disturbed by the Russia Forensic Investigation. 


Additionally, Independent Experts assert that the 
observed digital forensic evidence is more probable if 
Mr Mochalov executed the Zeroing Command to 
overwrite the “free space” of the Imaged Primary Disk 
with zeroes than if he did so to perform a “record speed 
check”. In any event, the result of this command is to 


153 Ibid. 

154 Command: “echo "" > /tmp/1.tmp”. 

155 Attachment F - WADA Evaluation Report, Part 5.4.5, page 23-24. 
156 Attachment F - WADA Evaluation Report, Part 5.3, pages 15-17. 
487 Attachment F - WADA Evaluation Report, Part 5.4.5, page 23-24. 
458 Attachment F - WADA Evaluation Report, Part 5.2.2, page 13-14. 
45° Attachment D - Counter Research, page 9. 


160 Attachment E - Answers to Technical Questions, page 12. 
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overwrite areas of the Imaged Primary Disk in the LIMS 
system with zeroes. 15” 


However, there is insufficient evidence to form a 
conclusion about the context in which Daily Backups 
were saved on the LIMS system before 17 December 
2018. 158 


11.2.3. The Secondary Disk 


The substantive issue is why the Imaged Secondary 
Disk contained no data. In other words, is it the real 
secondary disk and or has its contents been wiped. 


11.2.3.1 Russia Forensic Investigation 
The Russia Forensic Investigation asserts the following: 


(a) The Imaged Secondary Disk contained no data 
(because it was an “additional clean HDD”).15° 


(b) |The Imaged Secondary Disk was attached to the 
LIMS system on 17 December 2018, by Mr 
Mochalov, to improve the “reliability of the storage 
of information” .*6° 


(c) On 17 December 2018, the LIMS system was 
backdated to 11 August 2015. +64 


(d) The backdating of the time to 11 August 2015 
during formatting was a consequence of Mr 
Mochalov having “several windows open at the 
same time on his working computer, one of which 
was used by [him] to change time” and this 
“wrongly have the impression that the purpose of 
his actions was to create a file system” dated 11 
August 2015 when he executed the “file system 
creation commana” (i.e. formatting). 162 


(e) The Imaged Secondary Disk “file system” was 
“created” on the disk on 11 August 2015, and 
had not been mounted since. In other words, prior 
to its attachment by Mr Mochalov, the Imaged 
Secondary Disk had not been connected to a 
computer since 11 August 2015.16 


(f) Mr Mochalov selectively deleted the backdating 
and formatting Command Logs*® because he 


161 Attachment D - Counter Research, page 9. 


162 Attachment E - Answers to the eight (8) unanswered Technical 
Questions, page 7 (Question 7). 


163 At 14:21 hours or 2:21PM. 
164 Attachment D - Counter Research, page 9. 


165 Command Logs are a means of identifying commands executed 
on a system (e.g. Linux, UNIX) including modifications to the system 
and database. 
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wanted to preclude their accidental repeated (c) Whilst the system was backdated, the Imaged 
execution.16° However, the Russia Forensic Secondary Disk was formatted. Formatting sets 
Investigation was silent as to why these up the file system and cleans all reference to 
commands were used in the first place. existing and already allocated files. 1”2 

(g) There is no evidence that another secondary disk (d) Formatting a disk, the size of the Imaged 
was mounted or that backups were saved on it. 16? Secondary Disk, takes approximately 11 

173 174 

(h) The execution of a command (such as a Se Conas: 
command to format a disk) is not evidence that (e) At the time of formatting the Imaged Secondary 
the command was either successful or the Disk contained only zeros. +’5 

i j 168 
Solis ane ie Pe ianene Ompl ten: (f) Formatting does not overwrite a disk with 

(i) Therefore, it is not possible to “either zeros. 1/6 
unequivocally confirm nor rule out the possibility” : 
iit aac Secondary Disk ae (g) After formaiunegiie imaged pecomualy Disiowas 
(‘file system [was] created”) on 17 December never mounted to the system directory and was 
5018, 169 not used to store data.1”’ 

(j) Assuming the Imaged Secondary Disk was (h) The commands executed to back date the LIMS 
ena on 17 p Seetetie tn ft was system and format the Imaged Secondary Disk 
technically impossible to “purge” the disk’s entire ch vaccively pee trom we Command 
content during the 17 seconds that the formatting gS. 
commands were executed. 1” Review of Command Logs is a means for 

11.2.3.2 WADA Expert Analysis identifying commands executed on a system, 

— P ¥ including to make modifications to the system 

In exploration of these issues, Independent Experts and a database. The effect of deleting Command 

observed digital forensic evidence of the following: Logs is that the associated actions (backdating 

(a) The imaged Secondary Disk contained no data and formatting) are invisible without digital 
only zeros. The Zeroing Command mould forensic analysis. In other words, the Imaged 
overwrite this disk with zeros. However, while the pena) ie wa ee bs kits 
Command Logs suggests such commands were ate ae uauet engin’ 
run onthe “LIMS system”, no trace was found that ee , 
links the Zeroing Command directly to the (i) That “a” mounted +®? secondary disk existed in the 


Imaged Secondary Disk being overwritten with 
zeros.*/1 


(b) On 17 December 2018, the LIMS system was 
backdated to 11 August 2015. 


166 Attachment E - Answers to Technical Questions (Question 10), 
page 11. 


167 Attachment D - Counter Research, pages 12-13. 

168 Attachment D - Counter Research, pages 8-9. 

169 Attachment D - Counter Research, page 9. 

170 Attachment D - Counter Research, page 9. 

171 Attachment F - WADA Evaluation Report, Part 5.4.5, pages 23-24. 


12 Attachment F — WADA Evaluation Report, Part 5.4.7, pages 26- 
27. 


13 Attachment F - WADA Evaluation Report, Part 5.4.7, pages 26-27. 


14 Based on tests run by Independent Experts. 


LIMS system on 15 December 2018. 


Notably, this is contrary to the Russia Forensic 
Investigation which asserts that Mr Mochalov 
attached the secondary disk on 17 December 
2018. 182 


5 Attachment F - WADA Evaluation Report, Part 5.4.7, pages 26-27. 
6 Attachment F - WADA Evaluation Report, Part 5.2, pages 11-12. 
W7 Ibid. 

178 Attachment F - WADA Evaluation Report, Part 5.3, pages 15-17. 


179 Notably, as at 11 August 2015, Doctor Rodchenkov was still the 
Director of the Moscow Laboratory. 


180 The Data Retrieval Team arrived in Moscow on 17 December 
2018 but did not enter the laboratory until the follow day. 


181 Mounting a hard disk makes it accessible by the computer. This is 
a software process that enables the operating system to read and 
write data to the disk. Most disks are automatically mounted by the 
operating system when they are connected. 


182 Attachment F - WADA Evaluation Report, Part 3.2.1, page 7. 
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(j) | That “a” mounted secondary disk1®? existed in the 
LIMS system on 22 January 2016,184 and on 2 
April 2017. 185 


However, Independent Experts cannot state, based on 
observable forensic evidence, that the Imaged 
Secondary Disk was the same secondary disk 
observed in the system on 22 January 2016, 2 April 
2017 and 15 December 2018. Moreover, Independent 
Experts cannot determine what data existed in the 
secondary disk prior to 17 December 2018. 18 


The Russia Forensic Investigation did not comment on 
the following: 


(a) Evidence that the LIMS system had been 
configured to store daily automated databases 
backups to “a” secondary disk. 


(b) Evidence that “a” Secondary Disk existed in the 
LIMS system “on or before” 15 December 
2018. 187 


(c) Why the backdating and formatting commands — 
which were selectively deleted by Mr Mochalov - 
were executed on the LIMS system in the first 
instance. 


(dq) Why Mr Mochalov did not mount the Imaged 
Secondary Disk to the system directory so it could 
be used to store any data if his true purpose for 
connecting it was to improve “reliability in the 
storage of information”? 


11.2.4 Conclusion 


The Russia Forensic Investigation confirmed the 
findings by the Independent Experts that: 


On 17 December 2018, the Imaged Secondary Disk 
was formatted while the system was_ backdated, 
thereby making it appear the formatting occurred on 11 
August 2015.18 


Additionally, Independent Experts assert that the digital 
forensic evidence is “extremely more probable’ if “a” 
secondary disk existed in the LIMS system “on and 
before” 15 December 2018, rather than the Russian 


183 Independent Experts cannot say that the secondary disk mounted 
on or before 22 January 2016 and on 2 April 2017 was the same 
secondary disk imaged by WADA (i.e. The Secondary Disk) or 
another secondary disk. 


184 First reported in “PFS 19.0127”; see also Attachment F - WADA 
Evaluation Report, Part 5.2.1, pages 12-13. 


185 Attachment F - WADA Evaluation Report, Part 5.2.1, pages 12-13. 


186 Ibid. 
+87 Ibid. 
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proposition that a secondary disk (i.e. the Imaged 
Secondary Disk) was only attached on 17 December 
2018. 189 


The original finding by the Independent Experts that: 


The System Administrator — now known to be Mr 
Mochalov - selectively removed from history files the 
[Command Logs] that backdate the system to 11 
August 2015 and format the Imaged Secondary Disk, 


is corroborated by the Russia Forensic Investigation. 


However, there is insufficient digital forensic evidence 
to form a conclusion as to how the Imaged Secondary 
Disk came to be filled with zeros, or what data existed 
on the Imaged Secondary Disk before 17 December 
2018. 


11.3 ALTERATION OF LIMS SYSTEM 


In the WADA Technical Report, Independent Experts 


observed that on 17 December 2018, the LIMS system 
was back dated to 12 November 2015.1°° However, at 
that time they had not determined whether any 
alterations were made to the system during this period. 


11.3.1 Russia Forensic Investigation 


The Russia Forensic Investigation did not observe the 
17 December 2018 backdating of the LIMS system to 
12 November 2015, or the selective removal of the 
Command Logs. *9? 


11.3.2 WADA Expert Analysis 


Following further investigation, Independent Experts 
observed the following: 


(i) On or after 20 November and before 23 
December 2018, Moscow LIMS “logs.do” logs 
from the years 2012, 2013, 2014 and 201519 
were deleted; and 


188 Attachment F - WADA Evaluation Report, Part 3.4, pages 11-17. 
189 Ibid, Part 3.2.1, page 8. 


180 Attachment A - WADA Technical Report, page 8. In that report the 
date was incorrectly stated as 12 November 2018. The correct date 
was 12 November 2015. 


181 Attachment F - WADA Evaluation Report, Part 3.4.1, page 11. 


182 The earliest date for the 2015 “log_do” table deletions is on or 
after 23 November 2018, not 20 November 2018 like the other years. 
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(ii) | On 17 December 2018, not only was the LIMS 
system backdated to 12 November 2015, but 
“activities” were undertaken in the system. 1% 


Activities undertaken in a system are recorded in the 
Command Logs. However, whilst the system was 
backdated, portions of the Command Logs** were 
selectively deleted.1% 


Using specialized software, the deleted Command Logs 
were recovered. Examination of which revealed that 
whilst the system was backdated, files were opened 
and edited. 1% 


11.3.3 Conclusion 


The Russia Forensic Investigation has provided no 
information to counter the original finding by 
Independent Experts that, “On 17 December 2018, the 
LIMS system was backdated to 12 November 2015”. 


Therefore, Independent Experts were not able to 
evaluate the finding. 


11.4 FILE DELETION 


In the WADA Technical Report, Independent Experts 
observed that, “On 6 January 2019, 10,565 files and 
folders were deleted from the Moscow Laboratory 
computers”. Moreover, most of the deleted files 
contained the most relevant anti-doping data. 19” 198 


11.4.1.1 Russia Forensic Investigation 


The Russia Forensic Investigation assert the deletions 
were a consequence of an established annual practice 
by the Laboratory, executed by Mr Mochalov, to remove 
“unnecessary files” from instrument computers at the 
beginning of the year. Moreover, the files showed no 
“signs” of being associated with the results of “doping 
sample tests” and “most .... were removed from the 
operating system recycling bin”. |n other words, these 
files were unrelated to analysis results and most had 
already been deleted by other users at the time and 
were sitting in the recycle bins. +99 


183 Attachment F - WADA Evaluation Report, Part 3.4.1, page 13. 
484 Command Logs: “import_data” log files. 

185 Attachment F - WADA Evaluation Report, Part 3.4.1, page 11. 
196 Ibid, Part 3.4.1, page 13. 

187 7,309 “sequence” files, 336 Raw Data files and 187 PDFs. 


198 Attachment A - WADA Technical Report, (Appendix 
File_deleted_timestamp). 
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Consequently, the deletion activities of Mr Mochalov 
could not and did not “damage the integrity” of the 
Moscow Data.2 


11.4.1.2 WADA Expert Analysis 


During their evaluation of the Russia Forensic 
Investigation, Independent Experts identified that in fact 
15,325 files and folders had been deleted on 6 January 
2019, not 10,5652°!. It was further observed that 19,982 
files and folders had been deleted between the period 
of 1 January 2019 to 9 January 2019 (inclusively) — the 
day before the Independent Experts entered the 
Moscow laboratory. 


That said, contrary to the Russia Forensic Investigation, 
Independent Experts did not observe the established 
practice of removing unnecessary files at the beginning 
of any other years. Moreover, 15,743 (79%) of the files 
deleted between the 1 and 9 January had a creation 
timestamp between 2008 and 2017.2 


Furthermore, analysis by the _ Intelligence and 
Investigations Department of the 19,982 deleted files 
revealed that only 3,244 (15%) were in recycle bins. In 
other words, almost 85% of the deleted files were not in 
the recycle bin prior to deletion, moreover, they were 
deleted directly from their original path. 


Of the files in the recycle bin, some had been placed 
there in 2013, but most were moved there in 2016. In 
fact, 1,764 files from the recycle bin had a 
ThermoFisher2° file format or one that could be 
produced by a ThermoFisher instrument, such as PDF 
files. The 1,764 files included 507 Sequence files, 28 
PDFs and 328 Raw Data files. 


Of the 16,738 files not in the recycle bin at the time of 
deletion, 11,725 (70%) had a ThermoFisher file format 
or one that could be produced by a ThermoFisher 
instrument, such as PDF files. More specifically, the 
System Administrator - asserted by the Russia Forensic 
Investigation to be Mr Mochalov - deleted 11,213 
Sequence files, 503 PDFs and 9 Raw Data files. Of 
which 9,298 Sequence files, 500 PDFs and 1 Raw Data 
file had a creation timestamp between 1 January 2012 
and 31 December 2015. 


189 Attachment E - Answers to Technical Questions, pages 21-22. 
200 |bid, pages 21-22. 


201 Attachment F - WADA Evaluation Report, Part 3.6, pages 17-18; 
see also Attachment A - WADA Technical Report, Section 5.2. 


202 Attachment F - WADA Evaluation Report, Part 3.6, page 17. 


208 Since late 2013, ThermoFisher is the sole manufacturer of the 
analytical instrument used by the Moscow Laboratory. 
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11.4.1.3 Sequence files 


Sequence files are relevant to the investigation and the 
case file of each athlete, particularly for cases where 
there is a discrepancy between the WADA LIMS and 
the Moscow LIMS, as well as those cases where there 
has been a selective deletion of PDF and Raw Data 
files. A Sequence file records the code of the sample 
that was analysed as well as the name and path of the 
Raw Data that was ultimately generated. In a case 
where there had been a selective deletion of the 
Moscow Data, investigators could use a Sequence file 
to prove that a Raw Data file, and therefore the 
corresponding PDF, did exist. In other words, show that 
the WADA LIMS is correct. 


11.4.1.4 PDF analysis 


An analysis of the 503 PDF files deleted from the 
instrument computers between the 1 January 2019 and 
9 January 2019 indicated that most of them were not 
related to anti-doping samples (370). 


However, 133 PDF files were identified*°* that did 
relate to the analysis of anti-doping samples, including 
one in which the name of an athlete appeared in the file 
name. 2 


None of the 133 PDFs were in the recycle bin prior to 
their deletion but were found in the “Temporary Internet 
Files” folder on the ‘Homer’ instrument computer. 
Moreover, these 133 PDFs have a creation timestamp 
between 1 January 2012 and 31 December 2015 and 
most concern the ITP results for anabolic steroids 
analysis (121). Furthermore, an examination of the 
LIMS ‘pdfs’ table showed that these PDF files were 
originally transferred to the LIMS server further to their 
creation from the respective Raw files analyzed on the 
instrument computers. This means the PDF files did 
exist and were made available on the LIMS server. 
This, in addition to the presence of these files in the 
“Temporary Internet Files” folder, suggests these files 
were downloaded from the LIMS server on the ‘Homer’ 
instrument computer. 


204 Identification occurred through an analysis of the respective 
filenames. 


205 PDF file: “MMIO716_R98_1374033602[1].pdf’. Name 
redacted for privacy reasons. 


206 PDF: “a_09719 R98_1372942802/1].pdf’. 


207 The Target Group is comprised of 298 Russian athletes whose 
evidentiary circumstances (e.g. LIMS data) presented the more 
compelling “potential” cases of doping. 
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11.4.1.5 An example of a material impact 


While the following example pertains to an athlete 
identified as part of the “Target Group”, those athletes 
whom comprise the Target Group were known only to 
the Intelligence and Investigations Department. In other 
words, at the time of the data manipulation, Russian 
authorities are not believed to have known who was in 
the Target Group. 


That said, the Intelligence and_ Investigations 
Department has identified, out of the 133 above 
mentioned PDFs, one PDF file2°° (IAAF PDF) that was 
deleted from the instrument computer on 6 January 
2019 which was material to the case of a Target 
Group””’ athlete. 


The IAAF PDF related to a 2013 sample (Sample)? of 
a Russian female IAAF2°° athlete and was material 
because the ITP and Confirmation Procedure (CP) Raw 
Data were inexplicably “absent” from the Moscow Data. 
In other words, the PDF was, prior to its deletion, the 
only available analytical evidence. 


Moreover, there was a discrepancy between the WADA 
LIMS and the Moscow LIMS in that the WADA LIMS 
reported the Sample as producing a Presumptive 
Adverse Analytical Finding (AAF) for an anabolic 
steroid, methandienone, while the Moscow LIMS did 
not. In other words, the Moscow LIMS reported the 
Sample as ‘negative’. 


Notably, the Sample was subject of a “SAVE” directive 
issued by the then Russian Ministry of Sport. 22° 


The reason for the absence of ITP and CP Raw Data is 
not known and attempts to forensically recover the files 
have been unsuccessful. Independent Experts 
managed to “carve” two copies of the IAAF PDF from 
one of the Investigative Committee Disks (ICR 
Disks),*? however, evidence of selective content 
manipulation was observed for each PDF. 


The absence of any ‘existing’ copy of the IAAF PDF from 
the ICR Disks is not known. Notably, the file was 
successfully transferred to the LIMS server in 2013, as 
evidenced by the LIMS “pdfs” table and the existence of 


208 Sample 2779322 (Laboratory Code 9719). 
209 International Association of Athletics Federations. 


210 Refer EDP0120 and EDP0121. These documents have not been 
included din this report. They may be provided upon request. 


211 ICR-2. 
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the file in the “Temporary Internet Files” folder of the 
‘Homer’ instrument computer. 


To this end, the deletion of the IAAF PDF that occurred 
on 6 January 2019 has materially impacted the ability to 
conduct a thorough and complete investigation. 


11.4.2 Conclusion 


The original finding by Independent Experts that, “On 6 
January 2019, 15,325? files and folders were deleted 
from the Moscow Laboratory computers. Most of the 
deleted files contained the most relevant anti-doping 
data”, remains undisturbed by the Russia Forensic 
Investigation. 


Moreover, contrary to the Russia _ Forensic 
Investigation, Independent Experts assert that the 
observed digital forensic evidence is extremely more 
probable if the deletion of these files damaged the 
completeness of the Moscow Data, rather than the 
proposition of the Russia Forensic Investigation that the 
deletion of these files “cannot damage _ the 
completeness” of the Moscow Data. 


11.5 EVENTS OF 8 JANUARY 2019 


In WADA Technical Report, Independent Experts 
observed that on 8 January 2019, data in LIMS 
database, were deleted while the LIMS system was 
backdated, thereby making it appear the deletions 
occurred on 23 May 2015. A total of 623 files from 9 
folders? were deleted on this occasion. 


11.5.1.1 Russia Forensic Investigation 


The Russia Forensic Investigation asserts that on 8 
January 2019 the following occurred: 


212 As corrected with new valued form the WADA Technical Report. 


213 The files were deleted from the folders named “2012”, “2013”, 
“2014”, “2015”, “crm”, “crm_v2”, “forum”, “mysql” and “ref_urine”. 


214 Attachment D - Counter Research, page 16. 


215 Attachment D - Counter Research, page 15; See also Attachment 
E - Answers to Technical Questions (Question 10) (received on 22 
October 2019), page 10. 


216 Attachment F - WADA Evaluation Report, Part 3.7.3, page 21. 
217 Attachment D - Counter Research, page 16. 


218 Attachment D - Counter Research, page 16; See also Attachment 
E - Answers to Technical Questions (Question 31), page 19. 


218 Attachment E - Answers to Technical Questions (Q.15), page 14. 


220 “Russia Forensic Investigation Video” (“Russia LIMS Video’), 
commencing 6 minutes and 25 seconds. 


21 Between 15:00 hours and 15:09 hours. 
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(a) Mr Mochalov recovered “the LIMS databases” 
from the 21 December Backup.2"4 


(b) Mr Mochalov restored the LIMS database with the 
21 December Backup version.2!5 This restoration 
was done “before” the system was backdated. 216 


(c) During this process the “database become 
unstable” .21” 


(d) Mr Mochalov believed the system instability was 
a “timestamp” issue. Mr Mochalov attempted to 
correct the issue via means including, “via system 
time modification”. In other words, backdating of 
the LIMS system.228 


(e) The fore-dating of the LIMS system to 1 August 
2019 was the consequence of a “command input 
error’ by Mr Mochalov.?19 


(f) |The LIMS system date autocorrected.?2° 
11.5.1.2 WADA Expert Analysis 


On 8 January 2019,221 the System Administrator (i.e. Mr 
Mochalov) executed a script containing command that 
backdated the LIMS system to 23 May 2015 and 
then: 222 


(f) replaced the LIMS database with a prior version 
(Prior Version);27° 


(g) deleted 632 database files (e.g. OPT, MYD, MYI 
and FRM);2%4 225 


(h) backdated the timestamps of all database files. 276 


(i) Mr Mochalov then used automated scripts to alter 
the LIMS database and backdate multiple 
databases and associated files to various 
dates. 22” 


222 Attachment F - WADA Evaluation Report, Part 5.6.1, page 30; 
See also Attachment A - WADA Technical Report, Part 5.1.2, page 
8. 


223 Attachment F - WADA Evaluation Report, Part 5.6.3, page 31. 


224 OPT” files contain database characteristics and are updated 
every time a database is altered. “FRM” files describe a database 
tables format and structure. “MY1” files contain the index files of a 
database. “MYD” files contain data. When a MySQL LIMS database 
is used, all the database related data and metadata are stored ina 
folder with these files in it. These files are used for backup purpose 
for securing schema, data, and indexes, for migration or upgrade of 
the database. 


225 |bid, Part 5.6.2, page 31. The associated deletion timestamp was 
00:17 hours 23 May 2015. 


226 Attachment F - WADA Evaluation Report, Part 5.6.4, page 32. 
227 Ibid, Part 6, pages 43-44. 
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(j) Mr Mochalov subsequently deleted scripts 
designed to alter and backdate the LIMS 
database. 78 


The effect of these actions is that Prior Version now 
falsely appeared to have been on the LIMS system 
since 23 May 2015.29 


Following these events, the System Administrator fore- 
dated the LIMS system to 1 August 2019 (15:23 
hours). 22° 


As detailed in the CRC Report and now confirmed by 
the Russia Forensic Investigation, the setting of this 
date was a “command input error’? by Mr Mochalov 
who entered the date according to the United States 
format of year, day then month (“2019-08-01”). The 
system,?2 however, expected the date to be entered 
according to the European date format of year, month 
then day (“2019-01-08”). Consequently, 8 January 2019 
became 1 August 2019. 233 


At 03:05 hours on 9 January 2019, the LIMS system 
date autocorrected from 03:05 hours on 2 August 2019 
to 03:05 hours on 9 January 2019.24 


11.5.2 Conclusion 


The original finding by the Independent Experts that, 
“On 8 January 2019, data in LIMS database (623 files 
from 9 folders),?35 was deleted while the LIMS system 
was backdated, thereby making it appear the deletions 
occurred on 23 May 2015”, remains undisturbed by the 
Russia Forensic Investigation. 


Mr Mochalov’s backdating created the erroneous and 
fraudulent appearance that the LIMS database had 
existed since 23 May 2015. A misconception that could 
only be discovered by digital forensic analysis. 


Moreover, the backdating of the LIMS system was “not 
necessary for normal operation” of the LIMS databases. 
Furthermore, the Moscow LIMS application did not 
require such backdating to restore previous content. 236 


228 Ibid. 

229 Ibid, Part 5.6.4, page 32. 

230 Attachment F - WADA Evaluation Report, Part 5.10, pages 37-38. 
231 Attachment E - Answers to Technical Questions (Q.15), page 14. 
282 Ubuntu system. 

233 Attachment A - WADA Technical Report, page 9. 

234 Ibid, Part 5.1.2, pages 8-9. 


235 The files were deleted from the folders named “2012”, “2013”, 
“2014”, “2015”, “crm”, “crm_v2”, “forum”, “mysql” and “ref_urine”. 
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Lastly, contrary to the Russia Forensic Investigation, 
Independent Experts assert that the observed digital 
forensic evidence are extremely more probable if, on 
8 January 2019, while the LIMS system was backdated 
to 23 May 2015, the LIMS database was replaced with 
aversion that was not a fully authentic copy of the LIMS 
database, rather than the Russia Forensic Investigation 
proposition that “a fully authentic copy of the LIMS 
databases was placed on the test server.23" 


11.6 DELETION AND ALTERATIONS 
BETWEEN 6 AND 9 JANUARY 2019 


In the WADA Technical Report, Independent Experts 


reported that comparative analysis conducted by 
Independent Experts of recovered LIMS backups from 
5, 6, 9 and 10 January 2019 found selective 
differences. 238 


11.6.1.1 Russia Forensic Investigation 


The Russia Forensic Investigation acknowledged that 
the various LIMS backups had “minor differences”. 
However, they were not “deliberate distortions”.2°9 


In contextualizing these events, the Russia Forensic 
Investigation directed attention to the following: 


(i) On 22 December 2018 Mr _ Mochalov 
inadvertently migrated the 2008 to 2011 LIMS 
databases to the LIMS Server during his attempt 
to restore the 2016 Database. 4° 


(ii) | On 9 January 2019, to correct the continued and 
“worsening” instability within the LIMS system, Mr 
Mochalov deleted the entire “LIMS server 
database files” including those from 2008 to 
2011.*41 Mr Mochalov then restored the LIMS 
databases using the 21 December Backup, while 
also adding new data from “blood sample tests” 
conducted by the Moscow Laboratory between 
21 December 2018 and 9 January 2019. Mr 


236 Attachment F - WADA Evaluation Report, Part 5.6.4, page 32. 
°37 Ibid, Part 6 (“Conclusion”), page 45. 

238 Attachment C - WADA Technical Report, sections 5.2.3 and 6. 
239 Attachment D - Counter Research, page 20. 


240 Attachment D - Counter Research, page 22; See also Russia 
LIMS Video at the 5 minutes and 10 second mark. This event was 
previously discussed in this report (See Part 9.2.5, “Actions of Mr 
Mochalov’). 


41 Russia LIMS Video, commencing 6 minutes and 30 seconds. 
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Mochalov then added the ‘“log_do” and 
“log_error’ tables to the restored system. 


The inference being that the deletions observed by the 
Independent Experts were a consequence of Mr 
Mochalov correcting a problematic LIMS system whilst 
attempting to ensure a “full authentic copy of the LIMS 
databases” (2012 to 2019) was available on the LIMS 
Server for imaging and retrieval by WADA.?42 


Additionally, the Russia Forensic Investigation claimed 
that differences were caused by Mr Mochalov using 
information from “various sources when restoring the 
operability of the LIMS”.248 


In any event, the Russia Forensic Investigation asserts 
that these events “did not lead to the destruction or 
modification of information on the results of doping 
samples tests stored on the LIMS server databases”. 24 


11.6.1.2 WADA Expert Analysis 


As stated, comparative analysis of the recovered 
versions of LIMS databases contained “selective 
differences”.**° For instance, comparison of the 
“found’*46 and “confirmation’?*’ tables for the years 
2012, 2013, 2014 and 2015 revealed some records 
present in the 6 January 2019 version were absent from 
the 9 January 2019 version. Moreover, some values 
attributed to a sample in the LIMS have been changed 
between the versions.?“8 A more detailed analysis of 
these differences was outlined in the CRC Report.249 


The “found” (named “scr_results” in 2012) and 
“confirmation” (named “confirmations” in 2012) tables 
contain the most relevant anti-doping data, namely, the 
indication whether the presence of a Prohibited 
Substance in a sample was reported following the Initial 
Testing or Confirmation Procedure, respectively. 


Due to the complexity of the analysis, the investigation 
of the modifications between the 6 and 9 January 2019 
LIMS_ backups is still on-going. However, the 
Intelligence and Investigations Department has 


242 Attachment D - Counter Research, pages 15-16; See also Russia 
LIMS Video, commencing 7 minutes and 5 seconds. 


243 Attachment E — Answers to Technical Questions. 

244 Attachment D - Counter Research, page 20. 

245 Attachment A - WADA Technical Report, Part 6.1.2, Table 14. 
246 |n 2012 and prior, the “found” table was called “scr_results”. 


247 In 2012 and prior, the “confirmation” table was called 
“confirmations”. 


248 For example, in the 2012 database sample 8884, while in both 
versions, has different steroid profile values recorded in the Pro_4 
table of each version. 
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identified three samples reported ‘negative’ by the 
Moscow Laboratory where the forensic evidence shows 
the LIMS data was manipulated between 6 and 9 
January 2019. 


Example 1 


The first example pertains to a 2013 sample from an 
IAAF Russian female athlete (IAAF Sample)?°° who 
also appears on the Urine Bank.?54 


By way of summary: 


(i) | The WADALIMS reported (in the “founa” table) 252 
an elevated and suspicious steroid profile (SP) 
value, more specifically, a Testosterone to 
Epitestosterone (T/E)*°? ratio greater than 4. The 
suspicious SP value was also reported (in the 
“confirmation” table) as being confirmed?" by the 
Moscow Laboratory. 


(ii) |The data from the “recoverea” 6 January 2019 
version of the Moscow LIMS matched the WADA 
LIMS for the IAAF Sample. In other words, a T/E 
ratio greater than 4 and an entry in the 
“confirmation” table. 


(iii) The data from the “recovered” 9 January 2019 
version of the Moscow LIMS did not match the 
WADA LIMS for the IAAF Sample. Instead, this 
version of the LIMS reported a much lower and 
therefore non-suspicious T/E ratio of 2.3. 
Moreover, the entries in the “found” and 
“confirmation” tables had been deleted. 


(iv) The data from the Moscow LIMS (imaged by 
WADA on 12 January 2019) matched the 9 
January 2019 version. 


The totality of these circumstances necessarily implies 
that the SP values were manipulated - lowered from 
greater than 4 to a non-suspicious value of 2.3 - 
between 6 and 9 January 2019. 


248 See CRC Report, Part 9.2 “Comparative Analyses”, pages 19-20. 
50 Sample 2729640 (Laboratory Code 8884) 


251 See EDP0757. This document is not included in this report. It may 
be provided upon request. 


252 This table was later renamed the “found” table. 
253 The T/E ratio is the main parameter of the steroid profile. 


254 Reported in the “confirmation” table. 
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Example 2 


The second example pertains to a 2012 sample from an 
ISU255 Russian female athlete (ISU Sample). 2°6 


The Intelligence and Investigations Department had 
included this athlete in the Target Group and classified 
the ISU Sample (specifically, the Presumptive AAF for 
furosemide) as “Category 1”,25’ being the most 
suspicious category. 


By way of summary: 


(i) The WADA LIMS reported (in the “scr_results” 
table) a Presumptive AAF for furosemide*>® and 
a subsequently successful Confirmation 
Procedure (CP) (in the “confirmations” table). 


(ii) | The data from the “recovered” 6 January 2019 
version of the Moscow LIMS matched the WADA 
LIMS for the ISU Sample. In other words, a 
Presumptive AAF in the “scr_results” table and 
successful CP in the “confirmations” table. 


(iii) The data from the “recovered” 9 January 2019 
version of the Moscow LIMS did not match the 
WADA LIMS for the ISU Sample. In other words, 
the entries in the “scr_results” and 
“confirmations” tables had been deleted. 


(iv) The data from the Moscow LIMS (imaged by 
WADA on 12 January 2019) matched the 9 
January 2019 version. 


The totality of these circumstances necessarily implies 
that the Presumptive AAF and subsequently successful 
CP records were deleted between the 6 and 9 January 
2019. 


In addition to the LIMS manipulations, Independent 
Experts recovered a carved PDF from ICR-Disk 2259 
that related to the analysis of diuretics (e.g. furosemide) 
for the ISU Sample?®°. This PDF showed signs that the 
chromatogram of furosemide had also been selectively 
manipulated. 


255 International Skating Union. 
256 Sample 2728513 (Laboratory Code 12411). 


57 Category 1 identifies those samples with a concentration value 
above that which WADA-accredited laboratories are expected to be 
capable of identification. 


58 Substance from the Schedule 5 Class of the List (Diuretics and 
Masking Agents) are always prohibited. 


58 The “ICR” disks are three disks received from the Investigative 
Committee that were purportedly removed from the Moscow 
Laboratory on 21 July 2016. 


60 PDF generated from the “d_12411.raw’”. 
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Consequently, there is compelling evidence that 
manipulation of the ISU Sample was recent, targeted 
and thorough. 


Example 3 


The last example pertains to a 2013 sample from a 
WCF“! Russian female athlete (WCF Sample).26 


The Intelligence and Investigations Department had 
included this athlete in the Target Group. 


By way of summary: 


(i) | The WADALIMS reported (in the “founa” table) 26 
an elevated and suspicious steroid profile (SP) 
value, more specifically, a Testosterone to 
Epitestosterone (T/E)? ratio of 7.4. The 
suspicious SP value was also reported (in the 
“confirmation” table) as being confirmed?® by the 
Moscow Laboratory. 


(ii) | The data from the “recoverea” 6 January 2019 
version of the Moscow LIMS matched the WADA 
LIMS for the WCF Sample. In other words, a T/E 
ratio of 7.4 and an entry in the “confirmation” 
table. 266 


(iii) The data from the “recovered” 9 January 2019 
version of the Moscow LIMS partly matched the 
WADA LIMS for the WCF Sample. More 
specifically, the T/E ratio of 7.4 appeared in the 
“found” table, but the entry in the “confirmation” 
table had been deleted. In other words, the 
successful CP record?®” had been deleted. 


(iv) The data from the Moscow LIMS (imaged by 
WADA on 12 January 2019) matched the 9 
January 2019 version. 


The totality of these circumstances necessarily implies 
that the “confirmation” record was deleted between the 
6 and 9 January 2019. 


Moreover, the Intelligence and_ Investigations 
Department had originally flagged the WCF Sample as 


?61 World Curling Federation. 

262 Sample 2808583 (Laboratory Code 13564). 

263 This table was later renamed the “found” table. 

264 The T/E ratio is the main parameter of the steroid profile. 


65 Testosterone to Epitestosterone ratio value of 6.6 reported in the 
“confirmation” table. 


266 Testosterone to Epitestosterone ratio value of 6.6 reported in the 
“confirmation” table. 


267 Testosterone to Epitestosterone ratio value of 6.6. 
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“suspicious” for SP manipulation,2®® given that the 
WADA LIMS data was at odds with the T/E ratio of 3.4 
recorded in ADAMS, i.e. below the ratio value of 4 
triggering confirmation procedure. 


Finally, the Independent Experts recovered a carved 
PDF related to the analysis of anabolic steroids for the 
WCF Sample*® from ICR Disk 2. 


This PDF showed selective manipulation of the peak 
areas and reported concentrations for some specific 
compounds of the SP, namely Testosterone, 
Epitestosterone, DHEA and DHT. 


Consequently, there is compelling evidence that 
manipulation of the ISU Sample was recent, targeted 
and thorough. 


11.6.2 Conclusion 


The original finding by the Independent Experts that 
they had observed selective differences between the 
recovered LIMS backups from 5, 6, 9 and 10 January 
2019 found’ selective  differences,?”° remains 
undisturbed by the Russia Forensic Investigation. 


And further, Independent Experts assert that the 
observed digital forensic evidence regarding the 
selective differences between LIMS database backups 
recovered from unallocated space on the LIMS system 
is extremely more probable given the proposition that 
entries were selectively deleted and altered in the LIMS 
database between 6 and 10 January 2019, rather than 
the proposition of the Russia Forensic Investigation that 
the differences are “the result of the use of information 
from various sources when restoring the operability of 
the LIMS.272 


11.6.2.1 Investigator conclusion 


The circumstances of the data associated with the 
IAAF, ISU and WCF Samples provide overwhelming 
evidence that Mr Mochalov’s actions did result in the 
“destruction or modification of information on the results 
of doping samples tests stored on the LIMS server 
databases”. 


11.7 ALTERATIONS TO SERVER ONE 
To evaluate the Russia Forensic Investigation, 


Independent Experts conducted further digital forensic 
analysis on Server One. 


268 The Intelligence and Investigations Department identified this and 
other samples with suspicious Steroid Profiles to affected 
International Federations in March 2018. 


6° PDF generated from the “a_13564.raw’”. 
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11.7.1 Background 


Server One is the main server of the Moscow 
Laboratory. It was comprised of six disks. 


During the data retrieval mission, Russian Experts 
advised WADA that removing the disks of Server One 
may result in inability to restart Server One. Russian 
Experts proposed to transition (backup) the content of 
Server One onto a new server to enable WADA to 
forensically image the Server One disk without the risk 
of data loss to the Laboratory if the server did not 
ultimately restart. 


On 14 January 2019, WADA agreed to the proposal of 
the Russian Experts. 


By the afternoon of 16 January 2019, Russian Experts 
had completed the backup of Server One and WADA 
commenced forensic imaging of the six disks. 


11.7.2 Independent Experts Analysis 


Independent Experts observed digital forensic evidence 
of the following:2”2 


(a) On 16 January 2019, while Server One was 
backdated to 19 August 2015, a “system 
administrator’ executed commands to format a 
“secondary” disk from Server One, making it 
appear that the disk was formatted on 19 August 
2015. 


(b) A command was then executed to overwrite the 
“free space” of the “primary” disk in Server One 
with zeroes. 


(c) Server ONE contains digital traces compatible 
with a specialized tool being used to secure erase 
files on 16 January 2019. 


(d) On Server ONE, a “system administrator” 
selectively removed the Command Logs the 
commands that overwrite areas of a disk with 
zeroes and run a specialized tool to secure erase 
file. 


11.7.3 Conclusion 


By overwriting areas of a disk with zeros, a “system 
administrator’ renders traces of prior commands, 
activities and previously deleted data unrecoverable. 


The effect of a “system administrator’ selectively 
removing the Command Logs is that the associated 


270 Attachment A - WADA Technical Report, sections 5.2.3 and 6. 
271 Attachment F - WADA Evaluation Report, Part 5.7, page 33. 
272 Ibid, Part 5.11, pages 38-39. 
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actions on Server One were not observable without 
digital forensic analysis. 22 


To this end, digital forensic recovery was required to 
discover that commands were executed to overwrite 
areas of the “primary” disk in Server One with zeroes, 
to format “a “secondary” disk, and to use a specialized 
tool to secure erase files.2”4 


None of these actions have ever been communicated 
to WADA representatives. 


11.8. PDF ALTERATIONS 


On 6 September 2019, in assessing the impact of the 
identified data manipulation, the CRC Report detailed 
evidence of PDF manipulation. Similarly, the Russia 
Forensic Investigation reported PDF manipulation. 


Consequently, this issue is uncontentious as digital 
forensic evidence of PDF manipulation was observed by 
both WADA and Russian Experts. However, while 
Russian Experts identified manipulation via a specific 
script,2”° Independent Experts identified multiple 
methods of manipulation.?”6 


11.8.1 Conclusion 


Independent Experts assert that the observed digital 
forensic evidence is extremely more probable if 
multiple methods were used to alter PDF files rather 
than one method were used. 


12 ICR DISKS 


12.1.1 Background 


On 11 January 2019, the Investigative Committee 
delivered the ICR Disks (ICR-1, ICR-2 and ICR-3) and 
an accompanying protocol (Protocol) to WADA at the 
Moscow Laboratory. 


The Protocol is the Investigative Committee’s official 
account of the circumstances surrounding the 
inspection of the Moscow Laboratory by the 
Investigative Committee on 21 July 2016, and the 
seizure of the ICR Disks. The Protocol is purportedly 
constructed by the Investigative Committee in real-time. 
In other words, as events happen. 


WADA observed the ICR Disks were sealed in individual 
envelopes, each was labelled with a description of the 
contents and signed by those involved in its delivery and 


273 Ibid, Part 5.11, pages 38-39. 
274 Ibid. 


INTELLIGENCE AND INVESTIGATIONS DEPARTMENT 


receipt. However, the envelopes did not record the date 
or time they were sealed. According to the Investigative 
Committee, the envelopes had never been opened and 
the ICR Disks never examined. 


The Protocol recorded the ICR Disks as having been 
voluntarily provided to the Investigative Committee by 
the Moscow Laboratory. 


On 5 September 2019, the Intelligence and 
Investigations Department met with representatives of 
Minister Kolobkov and the Investigative Committee 
(Russian Delegation) in Lausanne, Switzerland. 


During the meeting the Russian Delegation confirmed 
that the the Investigative Committee had received the 
ICR Disks from the Laboratory and that they were either 
currently or previously in use by the LIMS server and 
“Server ONE”. The Delegation also claimed that on 21 
July 2016, the Investigative Committee transferred the 
Raw Data files from the computers interfaced with the 
respective instruments onto the ICR Disks and that this 
“transfer” of data has been mistakenly interpreted by 
WADA’s Forensic Experts as a deletion. 


In response to the above, Independent Experts 
conducted certain investigations. 


12.1.2 Mandate 


Independent Experts were asked to investigate the ICR 
Disks for evidence of modification as having occurred 
after 9 June 2016 and 21 July 2016 (Evidence of 
Modification). 


° 9 June 2016 was the last recorded instance of 
Remote Access to the “web interface” of the LIMS 
system. 


e 21 July 2016 was the date the ICR Disks were 
purportedly seized by the _ Investigative 
Committee. 


Additionally, Independent Experts were asked to 
examine the following three claims, made by the 
Russian Delegation: 


As at 21 July 2016, the ICR Disks were either currently 
or previously in use by the LIMS server and Server ONE 
(Claim One). 


On 21 July 2016, the Investigative Committee 
transferred Raw Data files from the computers 
interfaced with the respective instruments onto the ICR 
Disks (Claim Two). 


275 Script: “data.php”. 
276 Attachment F - WADA Evaluation Report, Part 4, page 10. 
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The “transfer” of the Raw Data files from the Instrument 
Computers has been mistakenly interpreted by the 
Independent Experts as a deletion (Claim Three). 


12.1.3 Evidence of Modification 


Forensic examination of the volume records of each 
ICR Disk revealed:2?? 


(i) ICR-1 had a file system creation date of 6 July 
2016. All files on ICR-1 have a creation date of 6 
July 2016, indicating that the disk was used to 
copy files on a single day, rather than being used 
as a backup disk for any longer period. 


(ii) |ICR-2 had a file system creation date of 5 July 
2016. All files on ICR-2 have a creation date of 5 
July 2016, indicating that the disk was used to 
copy files on a single day, rather than being used 
as a backup disk for any longer period. 


(iii) ICR-3 had a file system creation date of 14 
August 2015. All files on ICR-3 have a creation 
date of 14 August 2015, indicating that the disk 
was used to copy files on a single day, rather than 
being used as a backup disk for any longer 
period. 


Consequently, based on the above, Independent 
Experts observed evidence of modifications to the ICR 
Disks after 9 June 2016. However, no evidence of 
modification was observed after 21 July 2016.2”8 


12.1.4 Claim One 


Forensic analysis of Server ONE and the LIMS server 
did not find any references to the ICR Disks. 


However, there is insufficient available “contextual 
information from the computer system used to create 
the ICR Disks” to enable the Independent Experts to 
either dispute or verify Claim One.?279 


12.1.5 Claim Two 
12.1.5.1 Transfer of Raw Data Files 


Independent. Experts observed folders on_ the 
Laboratory instrument systems containing previously 
existing Raw Data files had changed to deleted state on 
21 July 2016. This deletion date is weeks after the 
creation dates of files on the ICR Disks (6 July 2016, 5 


277 Attachment G - Authentication of ICR Disks Report (“PFS 
19.0427’) (“WADA ICR Disk Report”), Part 3.2, pages 5-6. 


278 Attachment G - WADA ICR Disk Report, Part 4, page 10. 
279 Ibid, Part 4, pages 10. 
280 Ibid, Part 3.4, page 7. 
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July 2016 and 14 August 2015). Therefore, the deletion 
of Raw Data files on laboratory instrument systems 
(discussed in detail below) does not correspond with the 
transfer of files to the ICR Disks as proposed by Claim 
Two. 28° 


However, there is insufficient information to dispute or 
verify that ICR-1, ICR-2 and ICR-3 were created on 6 
July 2016, 5 July 2016 and 14 August 2015, 
respectively.28+ Consequently, Claim Two in respect of 
the “transfer” of files can neither be disputed or verified. 


12.1.5.2 Missing Raw Data Files 


The Intelligence and Investigations Department have 
identified to date that 110 Raw Data files produced on 
the Instrument Computer within the Laboratory are not 
present on the ICR Disks. Independent Experts have 
confirmed that none of the 110 Raw Data files are 
“existing” or listed as “previously existing” on the ICR 
Disks.282 


Examination of instrument systems confirms that none 
of the 110 RAW Data files are existing. This examination 
reveals that 58 out of the 110 RAW Data files are not 
listed as previously existing, and 52 are listed as 
previously existing. Of these previously existing files on 
instrument systems, 15 files were recovered, and their 
integrity was validated using a tool provided by Thermo 
Fisher. 283 


The fact that RAW Data files previously existed on 
instrument systems are not present on the ICR Disks, 
indicates that the data on the ICR Disks may not be 
complete and raises questions — but not conclusions - 
as to the veracity of Claim Two. 8 


12.1.5.3 Missing PDF files 


Based on analysis of LIMS data, particularly entries in 
the “pdf table, WADA specified a list of 120 PDF files 
that were produced in the Moscow laboratory but are not 
found on the ICR Disks.285 


Examination of ICR Disks confirms that none of the 120 
PDF files are existing, nor listed as previously existing. 
Moreover, examination of instrument systems confirms 
that none of the 120 PDF files are in an existing state on 
the file system. This examination reveals that 3 out of 
the 120 PDF files are listed as previously existing. One 


781 Ibid, Part 4, page 10. 
282 Ibid, Part 3.5, page 7. 
283 |bid. 
284 Ibid. 
285 Ibid, Part 3.6, page 8. 
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of these previously existing PDF files listed below has a 
deletion date on 06 January 2019. 286 


The fact that PDF files are listed in LIMS database 
tables, indicating that they previously existed, but are 
not found on the ICR Disks, indicates that data on the 
ICR Disks may not be complete and raises questions — 
but not conclusions - as to the veracity of Claim Two. 28? 


12.1.5.4 Missing PDF files found in deleted state 


Certain PDF files related to specific sample analysis are 
only found in deleted state in free space on the Disk 
ICR-2 using digital forensic file carving operations. 
These PDF files are missing from the corresponding 
group of existing files and were not recovered from any 
other disk. To determine the full extent of carved PDF 
files that are missing from the corresponding group of 
existing files, it would be necessary to perform an in- 
depth forensic analysis of specific cases and associated 
files. 288 


Because these carved PDF files do not have any 
associated file system metadata, it cannot be stated 
when they were copied or deleted on the Disk ICR-2.?°9 


The fact that PDF files are only found in deleted state in 
free space on the Disk ICR-2 using digital forensic file 
carving operations and are missing from the 
corresponding group of existing files, raises questions 
about the integrity and completeness of data on the Disk 
ICR-2.290 


12.1.5.5 Altered PDF content 


PDF files only found in deleted state in free space of the 
Disk ICR-2 using digital forensic file carving operations 
contain incongruities that indicate their content was 
altered after the original file creation. 2% 


The fact that PDF files found in deleted state in free 
space on the Disk ICR-2 using digital forensic file 
carving operations contain incongruities that indicate 
their content was altered after the original file creation, 
raises questions about the integrity and completeness 
of data on the Disk ICR-2.29% 


12.1.6 Claim Three 


Independent Experts observed that the folders on 
Laboratory instrument systems containing previously 
existing Raw Data files changed to deleted state on 21 


286 Ibid. 
287 Ibid. 
288 Ibid, Part 3.7, page 9. 
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July 2016. This deletion date is weeks after the creation 
dates of files on the respective ICR Disks (6 July 2016, 
5 July 2016 and 14 August 2015). Therefore, the 
deletion of Raw Data files on Laboratory instrument 
systems does not correspond with the transfer of files to 
the ICR Disks as indicated by the Russian Delegation in 
Claim Three. ?°3 


12.1.7 Conclusion 


Forensic analysis conducted in respect of these matters 
concluded as follows: 


(a) Absent specific contextual information from the 
computer system used to create the ICR Disks, 
there is insufficient information to verify that Disk 
ICR-1, Disk ICR-2 and Disk ICR-3 were created 
on 6 July 2016, 5 July 2016 and 14 August 2015, 
respectively. 


(b) No activities or alterations with dates after 6 July 
2016 were observed on the ICR Disks. 


(c) |The Russian Expert Claim One that “These hard- 
drives were either currently or previously in use by 
the LIMS server and Server ONE”, does not 
explain the fact that all activities on Disk ICR-1 
have creation timestamps on a single day (6 July 
2016), all activities on Disk ICR-2 have creation 
timestamps on a single day (5 July 2016), and all 
activities on Disk ICR-3 have creation timestamps 
on a single day (14 August 2015). 


(d) Absent specific contextual information from the 
computer system used to create the ICR Disks, 
there is insufficient information to verify Claim 
One that Disk ICR-1, Disk ICR-2 and Disk ICR-3 
were created using the Server ONE and the LIMS 
server. 


(e) The Russian Expert Claim Two that all files were 
copied to these three disks in July 2016 is 
incompatible with the creation timestamps of 14 
August 2015 on Disk ICR-3. 


(f) The transfer of files to the ICR Disks on and 
before 6 July 2016 does not correspond with 
deletion of Raw Data files on _ laboratory 
instrument systems in late July 2016 as indicated 
in Russian Expert Claim Three. 


290 Ibid. 

291 Ibid, Part 3.8, page 9. 

292 Ibid. 
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(g) The 110 Raw Data files missing from the ICR 
Disks raises questions that data on the ICR Disks 
may not be complete. 


(h) The 120 PDF files missing from the ICR Disks 
indicates that data on the ICR Disks may not be 
complete. 


(i) The fact that PDF files are only found in deleted 
state in free space on Disk ICR-2 using digital 
forensic file carving operations raises questions 
about the integrity and completeness of data on 
the ICR-2 Disk. 


(j) The fact that PDF files found only in deleted state 
in free space on Disk ICR-2 using digital forensic 
file carving operations contain incongruities that 
indicate their content was altered after the original 
file creation, raises questions about the integrity 
and completeness of data on the Disk ICR-2. 


(k) Files found in deleted state in free space do not 
have any associated file system metadata and, 
therefore, it cannot be stated when they were 
copied or deleted on the disk. 


13 FORUM MESSAGES 


The relevance of Forum Messages was first raised by 
the Russian Experts in a letter from Minister Kolobkov to 
WADA President, Sir Craig Reedie, on 26 August 2019. 
The letter revealed the discovery of “correspondence” 
(i.e. Forum Messages) between Doctor Rodchenkov and 
Doctor Timofey Sobolevsky which included, topics of 
“money transfer’ and “bonuses” in the context of “dirty 
samples”. 


Given the significance placed on the Forum Messages 
by the Russia Forensic Investigation, Independent 
Experts conducted a_ thorough digital forensic 
examination of this message exchange platform and its 
contents. 


It should be noted that all Forum Messages were in 
Russian and, where appropriate, have been translated 
(by a WADA appointed certified translator) to English for 
the purposes of this report. 


13.1 OVERVIEW 


As previously stated (see Part 10.2.3.3, above), the 
Russia Forensic Investigation asserts that specific 
Forum Messages exchanged between Doctor 
Rodchenkov and Doctor Sobolevsky evidence the 


294 Attachment C - Russia Technical Report (Part 1), page 6. 
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“receipt of money from sportspeople and trainers for the 
manipulation” of sample analysis results. 294 


However, as detailed below, forensic analysis of LIMS 
data found that between 25 November 2018 and 10 
January 2019, Forum Messages in the LIMS database 
were selectively altered to fabricate certain 
communications between Doctor Rodchenkov and 
Doctor Sobolevsky, as well as between Evgeny 
Kudryavtsev (Mr Kudryavtsev) and Anastasia 
Zharihina (Ms Zharihina). 


In other words, the Forum Messages produced in the 
Russia Forensic Investigation as evidencing the receipt 
of money by Doctor Rodchenkov and Doctor 
Sobolevsky in exchange for the manipulation of test 
results are fabricated and were “created” into the 


Moscow LIMS sometime on or after 25 November 2018. 


13.2 FORUM MESSAGES 


The LIMS web application includes a Forum Message 


feature for LIMS users to exchange messages as shown 
in Figure 1, below.2% 


Figure 1 


ry 


r > a ~ 
Pevcvaes sens ‘pages |Fapenirpams | Anmterpenie \OOC em Samoa eee Panpana |Cieecr # mesa 8 aaeperepan Covet 


The WADA LIMS contains 3,828 Forum Messages from 
25 March 2013 to 3 September 2015. 


The Moscow LIMS contains 11,227 Forum Messages 
from 25 March 2013 to 12 January 2019. 


Each of Forum Message is comprised of the unique 
identifier (ID) for the sender, recipient ID, sent 


85 WADA Alteration Report, Part 5.1, page 10. 
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timestamp, read timestamps, subject and message 


content as shown in Figure 2, below.2°° 


Figure 2 
to subject resage read 
» 7 ECORI 41, cae noNDNO na TECTORRI, HO MET Ze ME yRASERO 213-0402 15:14:58 
43 443 nanet, onpesteat vormmoneT PS 2013-03-28 13:31:45 
6 Tim, Ha BCE MpOURL ype! oTaaeN Senopycocyo NpoSy? 2013-03-27 18:03:29 
6 2b, HO BCE, mDONE EDDA -MoKs NOBEDEMEN MOWY. ToneKO HERO MpOCNe... 2013403-28 13:01:23 
2 Kpores BHEOt, NG, KDOTORA B CMCOK HCOMSITENET aHama NO HONE 1303-38 13:31:45 
Tpamcnor Oner, 446, nocTamma Tpanchor, nomep remcnagnal - 007-795632, nrpe... 2015-03-28 13:31:45 
TRMS rocbe: 2551 Cama, no sTol npoSe UCI npoorr sexcTamet> CueT 33 RMS HO Ha DH 14 
xpore camer 104 geen Hage 2013-05-28 13:31:45 
Posora omaneTax kOe 14 revewn Hasapen.2 ne Haaepon,nows 447 43 rovetan Hage... 2013-03-28 13:31:45 
6 Mere, 2x70 Taxol Hasapoe? Eon s1o womeal oxpereem, TOMAROKAKT... 2015-03-28 13:01:23 
2 POMeKE BnaKeTaX D0 104 noveen Hasanos.2 He Haseeno 47 4 rovean Hage... 2015-03-28 15:31:45 
ope MomocTeo ¢ Tool cornacem, yTOUNO y ADHCTOEa 2013-03-28 13:31:45 
boxe poe Oner, ane mary nonit 450 namiet - 970 Boxe nme npodeccnoanentsl 6... 2013-03-28 13:31:45 


Th remnewer tn ohacansi howe Urnnsenen 


WRN ates 


13.3 COMPARATIVE ANALYSIS 


A comparative analysis was conducted of the Forum 
Messages found in the WADA LIMS and the Moscow 
LIMS. Differences were observed, more specifically: 29” 


(i) | the content of three Forum Messages?% differ 
between the respective LIMS. In other words, the 
content of a message in the WADA LIMS is 
different to the content of the same message in 
the Moscow LIMS (Modified Messages). 


(ii) | 10 Forum Messages in the Moscow LIMS are not 
present in the WADA LIMS (Inserted Messages). 


(iii) | 25 Forum Messages present in the WADA LIMS 
are not present in the Moscow LIMS (Deleted 
Messages). 


Investigations were then undertaken to determine which 
version of the Forums Messages was true. The results 
of which are detailed below. 


14 FABRICATED EVIDENCE 


Following highly technical, protracted and expensive 
digital forensic analysis, Independent Experts have 
established that the Moscow LIMS contains fabricated 
Forum Messages. More specifically, on or after 25 


296 WADA Alteration Report, Part 5.1, page 12. 
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November 2018 but before 13:22 hours (1:22PM) on 10 
January 2019, an “unknown” person or persons: 


(i) Modified the content of three Forum Messages in 
the Moscow LIMS_ (ie. the Modified 
Messages); 299 


(ii) | Inserted 10 fabricated Forum Messages into the 
Moscow LIMS (i.e. the Inserted Messages);3° 
and 


(iii) | Deleted 25 Forum Messages from the Moscow 
LIMS (i.e. the Deleted Messages). 4 


Moreover, the sequence of alteration commenced with 
modification of the three Forum Messages, followed by 
the insertion of the 10 messages and, lastly, the deletion 
of the 25 messages. 


14.1 MODIFIED MESSAGES 


On 7 June 2013,°° in the WADA LIMS, Mr Kudryavtsev 


sent Doctor Sobolevsky a Forum Message*° stating 
“OK”. 


In the Moscow LIMS the message “OK” was removed 
and replaced with the words, “spoke with NO [HO]: we 
are definitely not going to put 2780034, 2780424 and 


homeless people... Treat all the files using the scheme, 
and you can take your Bonus home”. 


Moreover, Mr Kudryavtsev had been removed as the 
sender and replaced by Doctor Rodchenkov. In other 
words, the message now appeared as though Doctor 
Rodchenkov has sent it. 


The fabricated version of this message was specifically 
referenced in the Russia Technical Report.3% 


On 2 July 2013, 3 in the WADA LIMS, Mr Kudryavtsev 
sent Doctor Sobolevsky a Forum Message* stating 
“Tim, we will soon be giving it’. 

In the Moscow LIMS this message underwent several 
changes. 


Firstly, the parties were changed from Mr Kudryavtsev 
(sender) and Doctor Sobolevsky (recipient) to Doctor 


302 At 14:35 hours (or 2:35PM). 

303 Record ID: 217. 

304 Attachment C - Russia Technical Report, Page 14. 
305 At 10:55 hours (or 10:55AM). 

3°6 Record ID: 309. 
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Sobolevsky (sender) and Doctor Rodchenkov 
(recipient). 


Secondly, the time of the message was changed from 
10:55 hours (WADA LIMS) to 11:05 hours (Moscow 
LIMS). 


Thirdly, the time the message was opened (read) was 
changed from 10:55 hours (WADA LIMS) to 15:38 hours 
(Moscow LIMS). 


Lastly, the content was changed from “Tim we are about 
to sena” to the following: 


“Kudryavtsev is not releasing his aliquots, he is asking 
for a request! | propose we enlighten Kudryavtsev about 
our scheme involving the samples. We need to tell him 
straight and clearly, that we are creating the appearance 
of dirty samples, and the athletes and their trainers are 
bringing us bonuses. Otherwise he will suspect 
something dodgy is going on and will be unlikely to 
release any repeats without requests. This work has to 
be done very precisely. Alternatively, order him to stop 
fucking around and start handing over those aliquots. | 
prefer option number two :)”. 


The fabricated version of this message was specifically 
referenced in the Russia Technical Report.°°” 


On 2 July 2013,°°8 in the WADA LIMS, Doctor 
Sobolevsky sent Mr Kudryavtsev a Forum Message? 
stating, “Evgeny, | will clarify that’. 


In the Moscow LIMS this message underwent an almost 
complete change. 


Firstly, the time was changed from 10:59 hours to 15:36 
hours. 


Secondly, the sender was changed from Doctor 
Sobolevsky to Doctor Rodchenkov. 


Thirdly, the recipient was changed from Mr Kudryavtsev 
to Doctor Sobolevsky. 


Lastly, the content was changed from “!’m gonna get this 
straight’ to “Tim, calm down. | will have a talk with him 
later. It is all OK.”. 


The fabricated version of this message was specifically 
referenced in the Russia Technical Report. 1° 


307 Attachment C - Russia Technical Report, Page 14. 
308 10:59 hours (or 10:59AM). 
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14.2 INSERTED MESSAGES 


The following 10 Forum Messages were inserted into 
the Moscow LIMS.#4+ 


Commencing on 8 October 2013 and concluding 9 
October 2013, Mr Kudryavtsev and Anastasia Zharihina 
(Ms Zharihina), the Deputy of the Sample Reception 
and Storage Department,?1? had the following fictitious 
exchange of Forum Messages: 


Nastya, GMR and TS asked, if 
heavy athletics brought through, 
then the aliquots for that should be 
released at our maximum speed. | 
am staying here, but you go home, it 
is already late. 


Kudryavtsev: 


Zharihina: 


Zharihina: 


Okay, | understand. 


! am sorry, but | forgot to ask, 
obviously GMR is the director, but 
who Is TS? :). 


You surprise me! TS is Sobolevsky. 
And just in case, OM is Migachev. 


Kudryavtsev: 


The value in these four fabricated messages is they 
innocuously now establish that references in the Forum 
Messages to “GMR”, “TS” and “OM” are in fact 
references to Doctor Rodchenkov, Doctor Sobolevsky 
and Mr Migachev, respectively. 


Commencing on 2 October 2014 and concluding on 5 
October 2014, Doctor Sobolevsky and _ Doctor 
Rodchenkov had the following fictitious exchange of 
Forum Messages: 


Sobolevsky: Any news on Katina from heavy, 
11712? She has got str, so much time 


has passed... 


Rodchenkov: _ for the time being, we are definitely not 
putting anything out there on Adams. 
Wait a little. They should be bringing it. 


Syrtsov is everything to us! ... a 
renovated apartment and summer 
hous... 


Sobolevsky: met about Katina, | took it all. I'll pop by 


yours when you get back. 


311 WADA Alteration Report, Part 5.1.4, page 19. 
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Rodchenkov:  Timofey, | cannot get through to you by 
phone. Three samples will be brought 
in today t/a [m/a]. Take them and check 
them as quickly as possible. There 
should also be an envelope. Don't go 
blabbing. 


Well, it is a total fucking mess there. 
Oral turinabol, OXA, tren. At your 
discretion. 


Sobolevsky: 


Rodchenkov: — what fuckwits they are! 
14.2.1 Investigator Analysis 


These fabricated messages were all specifically 
referenced in the Russia Technical Report (albeit with 
some minor differences in translation) and were subject 
of detailed analysis and interpretation (See Part 13.2, 
“Forum Messages”, above).38 


The conclusion drawn by the Russia _ Forensic 
Investigation in respect of these messages is that they 
evidence Doctors Rodchenkov and _ Sobolevsky’s 
scheme of extortion and manipulation of analysis results 
for money. In other words, they were the figurative 
“smoking gun” of incrimination against Doctor 
Rodchenkov and Doctor Sobolevsky However, they 
were fabricated and “created” into the LIMS on or after 
25 November 2018, but before 10 January 2019. 


14.3 DELETED MESSAGES 


Independent Experts identified 25 Forum messages 
deleted from the Moscow LIMS - the most relevant of 
which have been included in this report.?14 


To contextualize the value in deleting these messages 
it is necessary to state the following: 


(i) Mr Kudryavtsev is party to 18 of the 25 deleted 
messages. 


(ii) | Mr Kudryavtsev was the head of reception, 
storage and aliquoting section of the Sochi and 
Moscow Laboratories. 


(iii) © Mr Kudryavtsev was named in an affidavit by 
Doctor Rodchenkov to the “Schmid 
Commission”? as being intimately involved in 
the swapping of samples in the Sochi Laboratory. 


313 Attachment C - Russia Technical Report, Page 14. 
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(iv) In addition to sample swapping, Doctor 
Rodchenkov revealed the existence of “pre- 
departure” testing of Russian athletes whereby 
select Russian athletes would be unofficially 
tested prior to competition to ensure their use of 
Prohibited Substances was not detectable. 


(v) Mr Kudryavtsev was a witness in the mostly 
successful appeal of 39 Russian athletes to the 
Court of Arbitration for Sport (CAS) following 
sanctions imposed by the International Olympic 
Committee Disciplinary Commission on the back 
of the McLaren Investigation and Schmid 
Commission. 


(vi) During the CAS proceedings, Mr Kudryavtsev 
vigorously disputed Doctor Rodchenkov's claims 
that a sanctioned subversion of the doping control 
process, orchestrated by the Russian Ministry of 
Sport and facilitated with the assistance of the 
Moscow Laboratory, operated in Russia. 
Moreover, Mr Kudryavtsev stated in evidence that 
he had decided to testify in the proceedings 
because he wanted to prove to the world that 
Doctor Rodchenkov was lying and that no 
sample-swapping occurred at the  Sochi 
Games.*16 


(vil) Mr Kudryavtsev’s credibility is essential to his 
effectiveness as a witness. 


14.3.1 Deletion Example 1 


On 18 September 2013, Mr Kudryavtsev sent Doctor 
Sobolevsky a Forum Message stating, 


“Tim, 2424: need to swap the registration with the other 
one and print the first three pages with the same dates 
and time, but under Kudryavtsev. Can't find Svishyev 
any more :)” 


14.3.1.1 Investigator Analysis 


This Forum Message suggests that Mr Kudryavtsev is 
directing the manipulation of the reception time of a 
sample received at the Moscow Laboratory, including 
reprinting the internal Chain of Custody (CoC) form. 


14.3.2 Deletion Example 2 


Commencing on 29 November 2013 and concluding on 
3 December 2013, Mr Migachev, Mr Kudryavtsev, 
Anastasia Zharihina (Ms Zharihina) and Doctor 


315 The Schmid Commission was established by the IOC to 
investigate allegations of Russian doping manipulations at the Sochi 
Games. 


316 CAS 2017/A/5379 Alexander Legkov v. International Olympic 
Committee (IOC), [352]. 
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Sobolevsky had the following Forum Message 
exchange: 


Mr Migachev to Mr Kudryavtsev: “Evgeny, please find 
the following pairs of samples: 13808 and 13807; 14809 
and 14810”.31’ 


Mr Kudryavtsev to Ms Zharihina: “Nast, please find the 
following pairs of samples: 13808 and 13807; 14809 
and 14810 A and B”.318 


Mr Kudryavtsev to Ms Zharihina: #19 


“Nast, PK is ready for analysis, tell Masha to write the 
time of receipt in [CoC] as 29.11.13 + 1 min after the 
handover. GR is in the refrigerator, in the [CoC] | wrote 
that | aliquoted it, please pour it out yourself and in our 
refrigerator, there are about 15 pre-departure samples, 
pour them out please for all the procedures. Good luck!” 


Mr Kudryavtsev resent this message about a minute 
later. 320 


Mr Migachev to Mr Kudryavtsev: “Evgeny, what is up 
with the other pairs of samples? Have they been 
found?” 321 


Mr Kudryavtsev to Mr Migachev: “yes, we have them, 
we found them”.322 


Mr Migachev to Doctor Sobolevsky: “13808 and 13807; 
14809 and 14810”.%23 


14.3.2.1 Investigator Analysis 


This Forum Message exchange suggests that Mr 
Kudryavtsev is directing the manipulation of an CoC 
form (referenced by the letters CoC aka “Chain of 
Custody”). Mr Kudryavtsev appears also to be asking 
Ms Zharihina to aliquot the samples although it appears 
he had already written on the CoC form that he had. 
Lastly, and most significantly, this message has Mr 
Kudryavisev referencing the existence of 15 “pre- 
departure” samples. 


14.3.3 Deletion Example 3 


On 15 December 2014 and 16 December 2014, Mr 
Kudryavtsev exchanged the following Forum Messages 
with Mr Migachev and Doctor Sobolevsky. 


At 18:16 hours (6:16PM) on 15 December 2014, Mr 
Migachev sent Mr Kudryavtsev a Forum Message 


317 15:16 hours (3:16PM) on 29 November 2013. 
318 18:53 hours (6:53PM) on 29 November 2013. 
319 20:51 hours (8:51PM) on 29 November 2013. 
320 90:32 hours (8:32PM) on 29 November 2013. 
321 11:15 hours (11:15AM) on 3 December 2013. 
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stating: “9095 4; 4093 5; 4733 5; 3491 6; 6315 6; 11083 
18; 11115 18; 11115 P2.010; 11083 P2.010.” 


This message appears to contain Laboratory Codes and 
an accompany analysis procedure (e.g. 9095 and 
analysis procedure “4” [anabolic steroids]). 


At 18:25 hours (6:25PM) on 15 December 2014, Mr 
Kudryavtsev replied, 


“Oleg, are you sure that is everything? Is this apart from 
the 21 substituted samples, or is it absolutely 
everything that had to be removed? | was with Tim 2 
hours ago and he was telling me that much more had to 
be changed.” 


No reply was observed in the Forum Messages. 


At 12:08 hours (12:08PM) on 16 December 2014, Mr 
Kudryavtsev sent Mr Migachev a Forum Message 
stating, “Oleg, please correct the time of receipt to 14:08 
as soon as possible. Thank you”. 


At 14:36 hours (2:26PM) on 16 December 2014, Mr 
Kudryavtsev sent Doctor Sobolevsky a Forum Message 
stating, “Please correct the time of receipt to 14:08 as 
soon as possible. Thank you.” 


14.3.3.1 Investigator Analysis 


This exchange of Forum Messages must be 
contextualised by the following: 


(a) On 3 December 2014, the German television 
channel ARD aired a documentary 
(Documentary) alleging the existence of state- 
sponsored doping in Russia _ (Protection 
Scheme).°?”4 


(6) On 9 December 2014, WADA, by letter, directs 
the Moscow Laboratory (i.e. Doctor Rodchenkov) 
to keep “all the A and B samples currently stored” 
in the facility. Moreover, the samples must be kept 
“frozen and under strict chain of custody until 
further notice by WADA” .325 


322 13:52 hours (1:52PM) on 3 December 2013. 
323 16:22 hours (4:22PM) on 3 December 2013. 


324 Hajo Seppelt (2014). Geheimsache Doping: Wie Russland seine 
Sieger macht. WDR / ARD Sportschau. 


325 9 December 2014 WADA letter to Doctor Rodchenkov. 
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(c) On 10 December 2014, WADA launched an 
Independent Commission (IC) to investigate the 
Documentary’s allegations. 326 


(d) On 11 December 2014, Doctor Rodchenkov 
asserts he was advised by the Ministry of Sport 
that WADA staff had applied for visa to Russia. °” 


(e) Expecting an imminent visit from WADA, Doctor 
Rodchenkov undertook extreme actions to 
conceal the Protection Scheme _ including 
discarding approximately 1,417°28 samples, 
falsifying CoC records and arranged for the 
“swapping” of select samples. 329 33° 


(f) ©On16 December 2014, WADA announced details 
of the three-person IC.331 


(g) On17 December 2014, a WADA team attends the 
Moscow Laboratory to secure and remove all 
samples currently stored in the facility. 


Against this background, the Forum Messages provide 
compelling “real-time” corroboration to Doctor 
Rodchenkov’'s evidence that in preparation for the 
WADA visit evidence was destroyed via means 
including sample swapping (“21 substituted samples”) 
and CoC record falsification (“Oleg, please correct the 
time of receipt...”). Moreover, Mr Kudryavtsev was an 
active participant. 


14.3.4 Other messages 


Deletion of highly relevant messages not involving Mr 
Kudryavtsev was also observed. For example: 


On 21 August 2014, Doctor Sobolevsky sent a Forum 
Message to Ms Zharihina stating, “the pH values have 
been cleaned up, so new values can be inserted. For 
density, too.” 


On 11 February 2014, Svetlana Garankina (Ms 
Garankina) sent a Forum Message to Mr Migachev 
stating, “Oleg, please delete the pH result and the 
density for sample 1170”. 


On 25 August 2014, Ms Garankina sent a Forum 
Message to Mr Migachev stating, “delete, please, the 


326 https://www.wada-ama.org/en/media/news/2014-12/wada-to- 
undertake-full-investigation-into-german-television-documentary 


327 See 7 December 2014 Affidavit of Doctor Rodchenkov, [65]. This 
document has not been included in this report. It may be provided 
upon request. 


328 WADA Independent Commission Report, page 203. 


32° See 7 December 2014 Affidavit of Doctor Rodchenkov, [65]. This 
document has not been included in this report. It may be provided 
upon request. 
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requests for repeat 10956 and 10966 (Krylova and 
Dikunets), to avoid recording in the [CoC]. We poured 
out the residue from the [Flacon]”.3°2 


14.4 CONCLUSION 


The fabricated, modified and deleted Forum Messages 
are a stunning deception. They are the figurative 
“smoking gun’. Moreover, their existence demonstrates 
intent and provides a lens through which the totality of 
manipulations within the Moscow Data should be 
observed. 


The modified and inserted messages evidence an intent 
to incriminate Doctor Rodchenkov, Doctor Sobolevsky 
and Mr Migachev. While the deleted messages 
evidence an intent to hide incriminating evidence and 
protect Mr Kudryavtsev, a key witness against Doctor 
Rodchenkov and his claims of state sanctioned 
subversion of the doping control process in Russia. 


The great effort required to establish this deception is 
evidenced by the fact that amongst the 11,227 Forum 
Messages stored within the Moscow LIMS, those 
responsible were able to identify and delete 25 highly 
inculpatory messages. 


15 NEW DATA 


15.1.1 Background 


On 23 October 2019, the Intelligence and Investigations 
Department received the New Data from a 
representative of Minister Kolobkov at the Geneva 
Airport, Switzerland. The New Data comprised a one 
terabyte hard drive?*° containing: 


(a) apurported copy of the virtual test server (Virtual 
Server); 


(6) a purported copy of the System Administrator’s 
(i.e. Mr  Mochalov) computer (System 
Administrator Computer); 


380 In preparation for the “swapping” Doctor Rodchenkov prepared a 
schedule of 37 samples he knew were “dirty” (“The Dirty Schedule”) 
[see EDP0648] Of the 37 samples, Doctor Rodchenkov believed 
there were six that need not be swapped as he could argue that the 
concentration of prohibited substances within the samples fell below 
the minimum reporting thresholds. 


331 See https://www.wada-ama.org/en/media/news/2014-12/wada - 
announces-details-of-independent-commission. 


382 A “flacon’ is a bottle. 


383 Serial Number: NAOVTGYJ. 
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(c) apurported copy of seven?" optical disk images 
(ISO Files). 


15.2 EVALUATION 


15.2.1 Virtual Server 


For the following reasons, the Virtual Server does not 
provide “trustworthy” information for evaluating the 
“Russia Forensic Investigation”:35 336 


(i) Historical “log files” automatically generated and 
archived by the operating system and relevant for 
forensic analysis were deleted between 18 
October 2019 and 22 October 2019. 3°” 


(ii) | The databases labelled “2011”, “2012”, “2013”, 
“2014”, “crm_v2” and “forum” have been deleted. 
Moreover, the database labelled “2015” was 
reinstalled on 20 June 2019. 338 


(iii) The “log_do” tables from all the databases 
(“2015”, “2016”, “2017”, “2018” and “2019”) were 
deleted on 20 June 2019. 399 


(iv) Multiple “blood_bag” related tables were deleted 
between 20 June 2019 and 5 September 2019. °° 


(v) Aversion of the LIMS database carved from the 
“free space” of the LIMS backup from 25 January 
2017 (2017 Backup) contained Forum Messages 
established**4 to have been modified and 
fabricated on or after 25 November 2018, but 
before 10 January 2019.°42 In other words, the 
backup contained forged data. 


(vi) Data present in the WADA LIMS and Moscow 
LIMS was absent from the 2017 Backup.#43 


(vii) Evidence of date inconsistencies within the 2017 
Backup between the completion date of the 
backup process and the observed records in the 
database. In other words, the 2017 Backup was 


334 New Data Report, Part 7, page 18. 


385 The Russia Forensic Investigation is comprised of the following: 
(i) Statement of Facts; (ii) Russia Technical Report; (iii) Counter 
Research; and (iv) Answers to Technical Questions. 


336 Attachment | — New Data Report, Part 8, page 21. 
387 New Data Report, Part 5.2.1, page 7. 

338 Ibid, Part 5.2.2, page 7. 

339 Ibid. 

340 Ibid. 

341 Attachment F - WADA Evaluation Report, Part 5.1. 
342 Ibid, Part 5.2.3, page 8. 
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not created on 25 January 2017 but “forged from 
later LIMS data” 344 


(viii) The presence of expected backup files of the 
LIMS server databases is not observed.#45 


(ix) Many logs files, relevant for forensic analysis, 
also appear to have been deleted between the 18 
October 2019 and the 22 October 2019. 


(x) | Content dated 5 July 2017 observed on the Virtual 
Server suggested the 2017 Backup was 
fabricated on or after this date. 246 


15.2.2 System Administrator’s Computer 


For the following reasons, the System Administrator's 
Computer does not provide “trustworthy” information for 
evaluating the “Russia Forensic Investigation: 


(i) the System Administrator's Computer had a new 
operating system installed on 16 September 
2019. °47 


(ii) | There are indications that the disk was possibly 
changed or wiped prior to being used to reinstall 
the new Linux operating system in the System 
Administrator’s Computer. 248 


(iii) An archive file of a LIMS database backup 
completed on 15 August 2018 (2018 Backup) 
observed on the System Administrator's 
Computer was found to contain Forum Messages 
established #49 by Independent Experts as having 
been modified and fabricated on or after 25 
November 2018, but before 10 January 2019, 35° 
In other words, the 2018 Backup contained forged 
data. 351 


(iv) Data present in the WADA LIMS and Moscow 
LIMS was absent from the 2018 Backup. 252 


(v) | Evidence of date inconsistencies within the 2018 
Backup between the completion date of the 


343 Ibid. 

344 Ibid, page 10. 

345 |bid, Part 5.3, page 11. 

346 Ibid, Part 5.2.3, page 10. 

347 Ibid, Part 6.2.1, page 12. 

348 Ibid. 

349 Attachment F - WADA Evaluation Report, Part 5.1. 
350 Ibid, Part 5.2.3, page 8. 

351 |bid, Part 6.2.3, page 15. 

352 Ibid. 
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backup process and the observed records in the 
database. In other words, the 2018 Backup was 
not created on 15 August 2018 but “forged from 
later LIMS data’”.353 


(vi) Content dated 30 August 2018 observed on the 
System Administrator's Computer suggests the 
2018 Backup was fabricated on or after this 
date. 54 


15.2.3 ISO Files 


The ISO Files contained compressed containers of 
LIMS database and web-server backups.*°5 However, 
these backups were generated on or after 5 August 
2019 and, therefore, do not provide data additional to 
that contained in the Moscow LIMS obtained by WADA 
on 17 January 2019. Consequently, the ISO Files can 
neither support nor contradict any claims made by the 
Russia Forensic Investigation. 356 


15.3 CONCLUSION 


The Virtual Server data and the System Administrator’s 
Computer are not trustworthy sources of information for 
evaluating claims made in the Russia Forensic 
Investigation. Furthermore, observed digital traces of 
data alterations and forged database backups raises 
questions about the integrity and completeness of the 
data. 


The ISO Files only contain backups generated on or 
after 5 August 2019 and, therefore, do not provide data 
additional to that already contained in the Moscow 
LIMS. Consequently, the ISO Files can neither support 
nor contradict any claims made in the Russia Forensic 
Investigation. 


16 EXPERT MEETING 


On 14 November 2019, the Intelligence and 


Investigations Department and Independent Experts 
met with Minister Kolobkov and the Russian Experts in 
Lausanne, Switzerland. 


The purpose of the meeting was to advise Minister 
Kolobkov of investigation findings arising from the 
Independent Experts’ evaluation of the Russia Forensic 
Investigation and to allow Russian Experts the 
opportunity to ask questions of the Independent 
Experts. 


353 Ibid, page 15. 
354 Ibid, page 16. 
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In delivering its findings, Minister Kolobkov was 
ultimately advised by the Intelligence and Investigations 
Department that the observable digital forensic 
evidence, when taken in its totality, revealed that the 
Moscow Data was altered prior to it being forensically 
copied by WADA. 


The comprehensive briefing provided to Minister 
Kolobkov and the Russian Experts included detailed 
summary of the following: 


(i) Events of 17 December 2018 
(ii) | Events of 8 January 2019 


(iii) | Discrepancies and alterations in the LIMS data 
between 6 and 9 January 2019 


(iv) Forum Messages; and 


(v) Areas of agreement and non-agreement between 
the parties. 


16.1.1 Expert question session 


Russian Experts were afforded over two and a half 
hours of question time with the Independent Experts. A 
significant portion of that time was used for general 
commentary or statements by the Russian Experts to 
reinforce matters previously raised by the Russia 
Forensic Investigation. For example: 


(i) Russian authorities had initially proposed a joint 
investigation of these matters, but this was 
rejected by WADA. 


(ii) | Russian Experts have not been given the 
opportunity to examine the WADA LIMS (received 
from a Whistleblower). 


(iii) | Doctor Rodchenkov, Doctor Sobolevsky and Mr 
Migachev have had two years to “create” any 
version of LIMS they want. 


(iv) Russian Experts do not trust Doctor Rodchenkov, 
Doctor Sobolevsky or Mr Migachev and, 
therefore, neither do they trust the WADA LIMS. 


(v) Russian Experts cannot exclude the possibility 
that Mr Migachev (or another) has manipulated 
data, has deleted or altered logs then restored 
them remotely to the LIMS system. 


(vi) The Investigative Committee has seized Doctor 
Rodchenkov’s Russian assets and_ financial 
analysis revealed that his asset base exceeded 
that which he could have reasonable and lawfully 


355 Attachment | - New Data Report, Part 7.1, page 18. 
356 Ibid, Part 7.3, page 20. 
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afforded on the wage earned as Director of the 
Moscow Laboratory. In other words, Doctor 
Rodchenkov was making money through his 
unlawful means. 


(vii) The LIMS routinely had operability issues and 
malfunctions. 


(viii) The System Administrator addresses operability 
issues through trial, error and his own technical 
expertise. There was no “instruction” manual for 
the LIMS. 


(ix) Errors were addressed by restoring the system 
with previous backup versions. 


(x) | Russian Experts have found multiple versions of 
LIMS backups. 


(xi) System Administrator made a backup of all 2012 
to 2015 data when he started in July 2016 and 
these old backups “can be stored anywhere” but 
is not sure where or if they can be trusted. 


(xii) LIMS was remotely controlled by Mr Migachev 
and Doctor Sobolevsky, from Los Angeles, until 
the arrival of the System Administrator (Evgeny 
Mochalov) in “July 2016”. 


(xiii) The System Administrator should not be blamed, 
rather, the data issues are a consequence of 
circumstances and trying to maintain LIMS 
operability. 


(xiv) Russian Experts do not accept the findings 
regarding the Forum Message __ fabrication, 
alteration and deletion until being provided with a 
technical report from Independent Experts and 
conducting their own investigations. 


(xv) Russian Experts do not accept the findings 
regarding the data alteration and discrepancies in 
the LIMS data between 6 and 9 January 2019, 
until being provided with a technical report from 
Independent Experts and conducting their own 
investigations. 


(xvi) The findings of the Independent Experts, made on 
“trace” digital forensic evidence, are finding based 
on assumptions only. 


Lastly, Russian Experts sought assurance that the LIMS 
“pook” and movie produced by Russian authorities in 
relation to the LIMS investigation had been considered 
by the investigation — which it had. 


357 See CRC Report (6 September 2019), Part 10. 


358 ThermoFisher Scientific. 
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In asking their questions, Russian Experts did not 
provide evidence or further technical material which 
required the Independent Experts to revisit their findings 
to date. 


16.2 CONCLUSION 


Russian Experts did not provide evidence or further 
technical material which required the Independent 
Experts to revisit their findings to date. 


Minister Kolobkov has personally undertaken to ensure 
Russian Experts investigate the fabricated, modified 
and deleted Forum Messages as well as the instances 
of deleted and manipulated LIMS data between 6 and 9 
January 2019. 


17 IMPACT 


17.1.1 Background 


The Intelligence and Investigations Department has 
previously reported on the impact that the absence of 
Raw Data files, manipulated PDFs and LIMS 
discrepancies has on the ability of pursuing Anti-Doping 
Rule Violations (ADRVs).°5” 


The following is a summary of those matters. 


17.2 RAW DATA AND PDF ISSUES 


In the CRC Report (6 September 2019), the Intelligence 


and Investigations Department reported that the validity 
of the Raw Data files recovered from the Moscow Data 
were determined using a proprietary software (Integrity 
Test) provided by the manufacturers*** of the analytical 
instruments (ThermoFisher) used in the Moscow 
Laboratory. This software purportedly identified when 
the content of a Raw Data file was incomplete or altered. 


It was originally conceived that manipulation of a Raw 
Data file, although not impossible, was so difficult and 
implausible to be discounted once a file has passed the 
Integrity Test. However, discrete instances have been 
identified where, based on circumstantial evidence, the 
veracity of a Raw Data file was highly questionable, 
despite passing the Integrity Test. 


A compelling example of such was included in the CRC 
Report (6 September 2019).%°9 


35° See Attachment “A” to the CRC Report (6 September 2019). 


50 


CONFIDENTIAL 


WORLD 
ANTI-DOPING 
AGENCY 


A pattern has appeared whereby the Raw Data was 
questionable in cases where there was a discrepancy 
between the respective LIMS databases, and the 
associated PDF to this Raw Data showed traces of 
manipulation. 36 


In other words, seemingly “valid” Raw Data files cannot 
be trusted when, for a specific sample, the data in the 
WADA LIMS does not match that in the Moscow LIMS. 
Notably, the nature of the discrepancy is the presence 
of a Presumptive AAF in the WADA LIMS but not in the 
Moscow LIMS. 


The uncertainty regarding the Raw Data in select 
instances was based on circumstantial evidence. 
Consequently, assistance was sought’ from 
Independent Experts to forensically examine 9 
suspicious ITP Raw Data files, identified by the 
Intelligence and _ Investigations Department, for 
evidence of digital inconsistencies. 


17.2.1 Forensic Analysis of suspect Raw Data files 


In short, Independent Experts reported that no digital 
trace of manipulation was detected in any of the 9 ITP 
Raw Data files.*° In other words, in respect of the files 
examined, there is currently no forensic means available 
to distinguish whether it has been manipulated. 


Enquiries with ThermoFisher were also undertaken. 
While acknowledging the possibility of manipulating a 
Raw Data file, ThermoFisher state that their 
investigation of the matter is not complete and cannot 
provide a time frame of when they will conclude. 


17.2.2 Missing Raw Data and PDF files 
17.2.2.1 Raw Data Files 


As previously reported, the Intelligence and 
Investigations Department identified 110 Raw Data 
files not present on the ICR Disks. 


Independent Experts have confirmed that none of the 
110 Raw Data files are “existing” or listed as “previously 
existing” on the ICR Disks.?6 


360 These PDFs were in a deleted state and had been recovered 
through ‘carving’. 


361 Attachment H - WADA Alteration Report, Part 4, page 9. This 
report appeared as an attachment on the WADA Evaluation report 
(11 November 2019). 


362 See CRC Report, 6 September 2019. 

363 Attachment G - WADA ICR Disk Report, Part 3.5, page 7. 
364 Ibid. 

365 Ibid. 
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Examination of instrument systems confirms that none 
of the 110 Raw Data files are existing. This examination 
reveals that 58 out of the 110 RAW Data files are not 
listed as previously existing, and 52 are listed as 
previously existing. Of these previously existing files on 
instrument systems, 15 files were recovered, and their 
integrity was validated using a tool provided by Thermo 
Fisher. 36 


The fact that Raw Data files previously existing on 
instrument systems are not present on the ICR Disks 
indicates that data on the ICR Disks is not complete. 2 


In any event, the time when the Raw Data files were 
deleted was investigated. Investigations focused on 
Confirmation Procedure (CP) Raw Data files only as 
they have more evidential value than the Initial Testing 
Procedure Raw files. 


Out of the 110 Raw Data files, 28 related to CP Raw 
Data files?®° and these files were only listed as 
previously existing on the instrument computers Adam, 
Maximus and Odin. 


As previously discussed by the Independent Experts, 3°” 
on 21 July 2016,76° multiple folders containing many 
Raw Data files from prior years were deleted from 
instrument computer systems. This deletion of folders 
resulted in mass deletion of all individual Raw Data files 
they contained. Moreover, the deletions were selective, 
targeted specific folders including “sochi’, “2014” and 
“2015”. 


The 28 missing CP Raw Data files pertain to 15 
samples. All 15 samples show discrepancies between 
the WADA LIMS and the Moscow LIMS. Moreover, 11 
of the 15 samples have an associated PDF from ITP 
Raw Data files which has been manipulated.?° 
Moreover, 9 of the 15 samples belong to athletes who 
are part of the Target Group”.?”° Notably, two samples, 
which relate to athletes not included in the Target 


366 Assessment was based on the path of the file 
(‘\Xcalibur\data\year\CONF\’) and the file name. 


387 Attachment A - WADA Technical Report. 


368 This observation was based on their last access date, which was 
on 21 July 2016. 


369 Notably, the ITP Raw Data files exist and do not report a 
Presumptive AAF. In other words, the ITP suggests the sample is 
‘negative’, while the CP Raw Data reports an AAF. 


370 Target Group: 298 athletes identified by the Intelligence and 
Investigations Department as having the most suspicious LIMS data. 
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Group, are also subject of current ADRV proceedings in 
a LIMS related prosecution.?”4 


17.2.2.2 Missing PDF files 


Based on analysis of LIMS data, particularly entries in 
the “pdf table, the Intelligence and Investigations 
Department identified 120 PDF files (relating to 95 
samples from Target Group athletes) that were 
produced in the Moscow Laboratory on Thermo Fisher 
instruments but are not found on the ICR Disks.?”2 


Examination of ICR Disks confirms that none of the 120 
PDF files are existing, nor listed as previously existing. 
Moreover, examination of instrument systems confirms 
that none of the 120 PDF files are in an existing state on 
the file system. This examination reveals that 3 out of 
the 120 PDF files are listed as previously existing. One 
of these previously existing PDF files listed below has a 
deletion date on 06 January 2019.378 


The fact that PDF files are listed in LIMS database 
tables, indicating that they previously existed, but are 
not found on the ICR Disks, further indicates that data 
on the ICR Disks are not complete.?”4 


A deeper analysis identified the following: 
(i) 87 PDFs related to anabolic steroid analysis; 


(ii) | 88 PDFs were directly related to a Presumptive 
AAF,?”> the absence of which materially affected 
the ability to investigate the associated athlete. 


(iii) 92 of the 95 samples showed discrepancies 
between the WADA LIMS and Moscow LIMS. 


(iv) 48 of the 95 samples had manipulated PDFs.?”6 
17.2.3 Conclusion 


In the 15 samples examined, a perfect correlation exists 
between a discrepancy in the LIMS data (WADA and 
Moscow LIMS) and both the absence of the CP Raw 
Data from the ICR Disks and their deletion from the 
Instrument Computers. 


In the 95 samples examined, a compelling correlation 
exists between the absence of the PDF from the ICR 
Disk, the existence of a Presumptive AAF, a 
discrepancy in the LIMS data (WADA and Moscow 
LIMS) and to a lower extent PDF manipulation. 


In other words, the absence of the Raw Data and PDF 
files appears targeted. 


371 The International Biathlon Union. 
372 Attachment G - WADA ICR Disk Report, Part 3.6, page 8. 
373 Ibid. 
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17.3 QUANTIFYING THE IMPACT 


At the outset, it is important to note that one athlete may 
have multiple samples in the Target Group. Therefore, 
impact has been assessed on a per athlete basis, 
meaning if an athlete has two samples in the Target 
Group and one sample is impacted by the data 
alteration, then the ability to investigate that athlete has 
been adversely impacted. 


From the Target Group, the data of 116 athletes (199 
samples) contain a material discrepancy between the 
Data Sources. Of the 182 athletes (379 samples) that 
do not have a discrepancy, Raw Data and PDFs are 
only available for 153 athletes (268 samples). In other 
words, data alteration has also impacted the ability to 
investigate the cases of 29 athletes (111 samples) 
where there is no discrepancy between the Data 
Sources. 


Quantification of the total impact is achieved by 
combining the LIMS discrepancy cases (116 athletes) 
with the absent Raw Data and PDF cases (29 
athletes), for a combined total of 145 athletes (310 
samples). In other words, an adverse impact of almost 
50% of the Target Group. 


17.3.1 Potential ADRVs 


To date, the Intelligence and Investigations Department 
has identified and forwarded prospective ADRV cases 
to the International Weightlifting Federation (IWF) (41 
athletes), United World Wrestling (1 athlete), World 
Taekwondo (2 athletes) and the International Canoe 
Federation (1 athlete). 


All these cases showed consistent and similar LIMS 
information within the WADA and Moscow Data. In 
other words, no discrepancies were observed for any of 
the sample of the respective athlete between the Data 
Sources. 


Of the 41 cases provided to the IWF, 12 athletes have 
been “notified” of ADRV proceedings and provisionally 
suspended. 


The Intelligence and Investigations Department has 
also provided the International Association of Athletics 
Federations (IAAF) with the data of all IAAF athletes, 
including that of the 66 IAAF athletes included in the 
Target Pool. The IAAF has carriage of all IAAF athletes, 


374 Ibid. 
375 In the WADA LIMS. 


376 Identified through Carving of the ICR-2 Disk. 
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including the investigation and identification of possible 
ADRVs. 


Two cases have also been commenced by the 
International Biathlon Union (IBU) against two athletes 
outside of the Target Group.?”’ The Intelligence and 
Investigations Department are assisting the IBU in this 
regard. 


Lastly, the targeted reanalysis?”° of the approximately 
2,262 samples - retrieved from the Moscow Laboratory 
as part of the Reinstatement Conditions — has, to date, 
resulted in 14 Adverse Analytical Findings (AAFs) from 
three International Federations. Notably, the 14 AAFs 
are the result of reanalysis from only 94 samples. 
Results Management of the 14 AAFs is_ being 
undertaken by RUSADA with the close assistance of 
the Intelligence and Investigations Department. 


17.3.2 Conclusion 


There is currently no forensic means available to 
distinguish whether a Raw Data file has been 
manipulated. 


However, investigations have established there is no 
evidence of Raw Data manipulation in cases where 
there is no discrepancy between the WADA LIMS and 
Moscow LIMS. 


Manipulation of Raw Data appears restricted to ITP 
Raw Data. 


The absence of Raw Data and PDF files appears 
targeted. 


The absence of Raw Data and PDFs has materially 
affected the ability to pursue ADRVs against select 
athletes. 


ThermoFisher continue to investigate the ability to 
identify digital trace evidence of Raw Data file 
manipulation. 


18 CONCLUSION 


Independent Experts have reviewed the New Data and 
the Russia Forensic Investigation and neither disturbs 
the findings of the WADA Technical Report. 


18.1.1 New Data 


In short, the New Data is not a trustworthy source of 
information for evaluating claims made in the Russia 
Forensic Investigation. Furthermore, observed digital 
traces of data alterations and forged database backups 


3’7 These two cases have discrepancies between the 2015 LIMS and 
2019 LIMS. 
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in the New Data raises questions about its integrity and 
completeness. 


18.1.2 Forensic Findings 


Based on confirmed facts, evaluative interpretation of 
forensic findings detailed in the WADA Evaluation 
Report, WADA Alteration Report, WADA ICR Disk 
Report and the WADA New Data Report, Independent 
Experts conclude that: 


Regarding observations confirmed by the Russia 
Forensic Investigation: 


(a) PDF files were altered. However, the Russian 
experts might not agree on the impact and scope 
of these alterations. 


(bo) Alterations to LIMS data in December 2018 and 
January 2019 were made by the System 
Administrator (i.e. Mr Mochalov) in the Moscow 
Laboratory from his working computer. The 
Russian experts might not agree on the impact 
and scope of these alterations. 


(c) On17 December 2018, on the LIMS system, the 
System Administrator deleted over 450 database 
backups of the Moscow LIMS database created in 
2016. 


(d) On17 December 2018, the System Administrator 
executed the command date -s "20150811 1721" 
which completed successfully to backdate the 
LIMS system to 11 August 2015. 


(e) On 17 December 2018, while the system was 
backdated to 11 August 2015 at 17:21 hours 
(5:21PM), the System Administrator executed 
commands which completed successfully to 
format the secondary disk in the LIMS system. 


(f) On the LIMS system, the System Administrator 
selectively removed from history files the 
commands that overwrite areas of the primary 
disk in the LIMS system with zeroes, backdate the 
system to 11 August 2015, and format the 
secondary disk. The effect of selectively removing 
such commands from history files and deleting 
scripts for altering and backdating the LIMS 
database and Server ONE was that these 
activities (and those of the System Administrator) 
were not discoverable without advanced digital 
forensic analysis. Digital forensic recovery and 
analysis was required to discover that commands 


378 The targeted reanalysis is based on criteria 
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(9) 


(h) 


(i) 


(i) 


(k) 


(!) 


(m) 


and scripts were executed to perform backdating 
and alterations of the LIMS system and database. 


On 8 January 2019, the System Administrator 
backdated the LIMS system to 23 May 2015 using 
the command date -s "2015-05-23" and then 
replaced the LIMS database with a prior version. 


On 8 January 2019 (while the LIMS system was 
backdated to 23 May 2015) hundreds of LIMS 
database files (e.g. OPT, MYD, MYI and FRM) 
became in deleted state. 


On 8 January 2019, the System Administrator 
backdated database files to 23 May 2015. 


The System Administrator used automated scripts 
to alter the LIMS database and backdate multiple 
databases and associated files to various dates. 


The System Administrator deleted scripts 
designed to alter and backdate the LIMS 
database. 


Between 9 and 10 January 2019, because of the 
System Administrator's actions on the LIMS 
system, the databases labelled “2008”, “2009”, 
“2010” and “2011” present in the recovered 
database backup from 9 January 2019 were 
removed from the recovered database backup 
from 10 January 2019. 


On 8 January 2019, the fore dating of the LIMS 
system to 1 August 2019 was caused by the 
System Administrator executing the command 
date -s "2019-08-01 15:23" with the date 
mistakenly in incorrect format. 


Regarding observations not included or reported in the 
Russia Forensic Investigation: 


(a) 


(b) 


(c) 


(d) 


On 17 December 2018, the LIMS system was 
backdated to 12 November 2015. 


On 17 December 2018, while the LIMS system 
was backdated to 12 November 2015, database 
files were altered and became in deleted state. 


On 17 December 2018, on the LIMS system, log 
entries dated 12 November 2015 were selectively 
removed from a backup log file. 


On the LIMS system, log entries dated 12 
November 2015 were selectively removed from a 
system log file. Digital forensic recovery was 
required to find these log entries and establish 
that backdating occurred. Subsequently, the 


379 Whilst this is suspected to have been Mr Mochalov, to date, this 
has not been acknowledged by Russian authorities. 
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touch command was used to alter the last 
modified date of the edited log file, and this 
command was selectively removed from history 
files. Digital forensic recovery was required to find 
this touch command and determine that the last 
modified date of the edited log had been altered. 


On the LIMS system, digital forensic carving 
operations and in-depth analysis of MYD files as 
described in the WADA Technical Report found 
remnants of record deletion between 6 and 9 
January 2019. 


On 16 January 2019, while Server ONE was 
backdated to 19 August 2015, a system 
administrator?’ executed commands to format a 
secondary disk, making it appear that the disk 
was formatted on 19 August 2015. 


On Server ONE, the command “ddrescue -f 
/dev/zero rfc” was executed to overwrite free 
space of the primary disk in Server ONE with 
zeroes. 


Server ONE contains digital traces compatible 
with a specialized tool being used to secure erase 
files on 16 January 2019. 


On Server ONE, a_ system administrator 
selectively removed from history files the 
commands that overwrite areas of a disk with 
zeroes and run a specialized tool to secure erase 
files. 


Regarding the evaluation of forensic observations 
detailed in this report on which the Independent Experts 
do not agree with the propositions in the Russia 
Forensic Investigation: 


(a) 


(b) 


The observed digital traces are extremely more 
probable given the proposition that a secondary 
disk existed in the LIMS system before 15 
December 2018, rather than the proposition that 
a secondary disk was only attached on 17 
December 2018. 


The observed digital traces are much more 
probable given the proposition that, on 17 
December 2018, the command “dd if=/dev/zero 
of=/tmp/1.tmp bs=10240k" was executed to 
overwrite free space of the primary disk in the 
LIMS system with zeroes, rather than to perform 
“a record speed check” on the LIMS hard drive. 
Either way, the result of this command is to 
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overwrite areas of the primary disk in the LIMS 
system with zeroes. 


(c) The observed digital traces are far more probable 
given the proposition that the backdating and 
formatting commands were executed together, 
rather than the proposition that the backdating 
and formatting commands were executed 
separately, as alleged in the Russian responses. 


(d) The observed digital traces are extremely more 
probable given the proposition that, on 8 January 
2019, while the LIMS system was backdated to 23 
May 2015, the LIMS database was replaced with 
a version that is not a fully authentic copy of the 
LIMS database, rather than the proposition that “a 
fully authentic copy of the LIMS databases was 
placed on the test server.” 


(e) The observed digital traces of missing files are 
extremely more probable given the proposition 
that the deletion approximately 20,000 files after 
1 January 2019 damaged the completeness of the 
data provided by the Moscow Laboratory to 
Independent Experts, rather than the proposition 
that “the deletion of these files cannot damage the 
completeness of the data provided by the Moscow 
Laboratory to Independent Experts.” 


(f) The observed digital traces of selective 
differences between LIMS database backups 
recovered from unallocated space on the LIMS 
system are extremely more probable given the 
proposition that entries were selectively deleted 
and altered in the LIMS database between 6 and 
10 January 2019, rather than the proposition that 
these differences are “the result of the use of 
information from various sources when restoring 
the operability of the LIMS.” 


(g) The observed digital traces are extremely more 
probable given the proposition that a specialized 
secure erase tool was used to secure erase files 
on LIMS system in January 2019, rather than the 
proposition that “it is not possible to determine 
more precisely the time of use of this program.” 


Lastly, regarding observed activities that could not be 
investigated: 


(a) Due to absence of information from before 17 
December 2018, it is not possible to determine if 
backup files created by the automated daily 


380 The Moscow LIMS is the forensic copy of the Moscow Laboratory 
LIMS imaged by WADA on 12 January 2019. 


381 Doctor Rodchenkov asserted the existence of “pre-departure” 
testing of Russia athletes whereby select Russian athletes would be 
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backup operation were stored on the primary disk 
or the secondary disk on the LIMS system. Under 
normal operations, we would expect under normal 
operations these backups to be present, but no 
such backup files exist on either the primary disk 
or the secondary. The Data and information given 
to WADA do not provide enough information to 
support a conclusion about the context that 
resulted in the secondary disk in the LIMS system 
being filled zeroes before it was formatted on 17 
December 2018. 


(b) The Data and information given to WADA do not 
provide enough information to support a 
conclusion about the context that resulted in the 
secondary disk in Server ONE being filled zeroes, 
before it was formatted, on 16 January 2019. 


(c) The Data and information given to WADA do not 
provide enough information to support a 
conclusion about what data were stored on a 
secondary disk in Server ONE before it was 
formatted, on 16 January 2019. 


18.1.3 Forum Messages 


Independent Experts discovered that on or after 25 
November 2018, but before 10 January 2019, a person 
or persons unknown fabricated, modified and deleted 
messages (Forum Messages) from within the Moscow 
LIMS.380 


More specifically, Forum Messages referenced by the 
Russia Forensic Investigation as evidencing extortion 
and the doctoring of analysis results by Doctor Grigory 
Rodchenkov, Doctor Sobolevsky and Mr Migachev were 
fabricated and falsely “created” into the Moscow LIMS 
on or after 25 November 2018. 


In addition, Forum Messages’ evidencing the 
involvement of Mr Kudryavtsev in sample swapping, 
“pre-departure” 281 sample analysis and the falsification 
of laboratory chain-of-custody records were deleted 
from the Moscow LIMS on or after 25 November 2018. 
Notably, Mr Kudryavtsev’s sample swapping and record 
falsification activities immediately preceded WADA’s 17 
December 2014 attendance at the Moscow Laboratory 
and ultimate removal of 4,144 “unique” samples. 


18.1.4 Scenario of Events 


Based on confirmed facts, evaluative interpretation of 
forensic findings and the Russia Forensic Investigation, 


unofficially tested prior to competition to ensure their use of 
Prohibited Substances was not detectable. 


55 


CONFIDENTIAL 


WORLD 
ANTI-DOPING 
AGENCY 


the Intelligence and _ Investigations Department 
proposes the following scenario of events as 
contextualising and evidencing the manipulation of the 
Moscow Data: 


On 29 November 2013, Mr Kudryavtsev sent a Forum 
Message to a colleague advising that there were 15 
“pre-departure” samples requiring analysis. 
Predeparture testing was the unofficial analysis of 
samples from select Russian athletes prior to 
competition to ensure their use of Prohibited 
Substances was not detectable. Mr Kudryavtsev also 
directed the colleague to falsify Laboratory chain-of- 
custody records. 


Between February 2014 and July 2016, LIMS database 
backups were generated on the “primary” disk of the 
LIMS server (i.e. the Imaged Primary Disk), in a specific 
directory. Notably, the LIMS system had _ been 
configured to extract and store daily automated 
databases backups (i.e. Automated Backups). Backups 
of the LIMS system are valuable as they provide a 
reference point of comparison to identify altered or 
missing data from the Moscow Data. The absence of 
backups is considered suspicious. 


On 3 December 2014, the German television channel 
ARD aired a documentary alleging the existence of the 
Protection Scheme in Russia. 


On 9 December 2014, WADA, by letter, WADA directed 
the Moscow Laboratory (i.e. Doctor Rodchenkov) to 
retain all samples until further notice by WADA. 


On 10 December 2014, WADA launched an 
Independent Commission (IC) to investigate the ARD 
Documentary allegations. 


On 11 December 2014, Doctor Rodchenkov was 
advised by the Russian Ministry of Sport that WADA 
staff had applied for visas to Russia. Expecting an 
imminent visit by WADA and the seizure of samples, 
Doctor Rodchenkov discarded samples, swapped 
samples and falsified CoC records. 


On 15 December 2014, Mr Kudryavtsev received a 
Forum Message containing several sample (Laboratory) 
codes from Mr Migachev. Mr Kudryavtsev replied asking 
if these samples were apart from the “21 substituted 
samples, or [was] it absolutely everything that had to be 
removed?” 


In this context the term “substituted samples” denotes 
the practice of sample swapping, whereby the contents 


382 Mounting a hard disk makes it accessible by the computer. This is 
a software process that enables the operating system to read and 
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of a “dirty” sample is replaced with urine clear of 
Prohibited Substances. 


On 16 December 2014, Mr Kudryavtsev asked Mr 
Migachev via a Forum Message to falsify CoC records. 


On 16 December 2014, WADA announced details of the 
three-person IC. 


On 17 December 2014, a WADA attended the Moscow 
Laboratory to secure and remove all samples stored in 
the facility. 


On 9 November 2015, WADA received the IC’s Report 
Part One. 


On 17 November 2015, Doctor Rodchenkov fled Russia 
for the United States. 


On 18 November 2015, RUSADA was declared non- 
compliant. 


On 14 January 2016, WADA received the IC’s Report 
Part Two. 


On or before 22 January 2016, “a” mounted “secondary” 
disk existed in the LIMS server. 3° 


On 15 April 2016, WADA revoked the accreditation of 
the Moscow Laboratory. 


On 19 May 2016, WADA announces the _ IP 
Commission. 


On 9 June 2016, the Moscow LIMS was remotely 
accessed for the last time. 


On 29 June 2016, the backups of the Moscow LIMS 
created in 2014 and 2015 were deleted from the Imaged 
Primary Disk. 


On 18 July 2016, WADA received the IP’s Report Part 
One. 


On 19 July 2016, the IOC announce the “Schmid” 
Commission. 


On 21 July 2016, the ICR enters the Moscow Laboratory 
to secure evidence in their investigation of Doctor 
Rodchenkov. 


Between 21 July 2016 and 25 July 2016, a vast number 
of files, including Raw Data files, were deleted from 12 
instrument computers and the Imaged Primary Disk. 


On 2 August 2016, the Automated Backup script was 
run on the Imaged Primary Disk. However, Independent 
Experts cannot determine whether it continued to run on 


write data to the disk. Most disks are automatically mounted by the 
Operating system when they are connected. 
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the Imaged Primary Disk or was subsequently run on a 
“secondary” disk. 


Notably, database backup files generated between 
August 2016 and 17 December 2018 by the Automated 
Backup script do not exist on either the Imaged Primary 
Disk or the secondary disk as imaged by WADA (i.e. the 
Imaged Secondary Disk). This absence is suspicious. 


On 9 December 2016, WADA received the IP’s Report 
Part Two. Accompanying this report was a release of the 
non-confidential evidence (Evidence Disclosure 
Package (EDP)). EDP’s were publicly available via a 
website. 


On 2 April 2017, “a” mounted secondary disk existed in 
the LIMS system. However, Independent Experts 
cannot state, based on observable forensic evidence, 
that this secondary disk was the same secondary disk 
observed in the system on 22 January 2016 or the 
Imaged Secondary Disk. 


On 20 September 2018, the importance and intended 
purpose of the Moscow Data became known to Russian 
authorities with the introduction of the Reinstatement 
Conditions. 


On 16 October 2018, WADA advised Minister Kolobkov, 
via letter, that the Moscow Data was sought solely to 
identify those athletes who may have committed anti- 
doping rule violations. 


On or after 20 November 2018 but before 23 December 
2018, logs from the Moscow LIMS “/og_do” table from 
the years 2012, 2013 and 2014 were deleted. 


The “log_do” table housed data files (Logs) that record 
events and a user’s actions in a computer operating 
system (i.e. Moscow LIMS). 


On or after 23 November 2018 but before 23 December 
2018, logs from the Moscow LIMS “log _do” table for 
2015 were deleted. 


On or after 25 November 2018, select Forum Messages 
were fabricated, modified and deleted in the LIMS 
system by an “unknown” person. 


On 27 November 2018, WADA arrived in Moscow to 
discuss operational issues related to retrieving the 
Moscow Data. 


On 15 December 2018, “a” mounted secondary disk 
existed in the LIMS system. However, as previously 
stated, Independent Experts cannot state, based on 
observable forensic evidence, that this secondary disk 


383 Table “forum_t’ is the Forum Message table. 
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was the same secondary disk observed in the system 
on 22 January 2016 or 2 April 2017. 


On 17 December 2018, late in the afternoon, WADA 
arrived in Moscow to obtain a forensic copy of the 
Moscow Data. No data would be copied on this 
occasion. 


On 17 December 2018, “a” secondary disk existed in the 
LIMS system. This disk (i.e. the Imaged Secondary 
Disk) was ultimately forensically imaged by WADA. 
Notably, Russian Experts assert the Imaged Secondary 
Disk was first introduced to the LIMS system on this day. 
However, because of actions undertaken within the 
system on 17 December 2018, Independent Experts 
cannot state that the Imaged Secondary Disk was the 
same secondary disk observed in the system on 22 
January 2016, 2 April 2017 or 15 December 2018. 


On 17 December 2018, the following events occurred 
in the Moscow Laboratory: 


(a) The “system administrator’, Evgeniy Mochalov, 
backdated the LIMS system to 12 November 
2015 -— a date five days before Doctor 
Rodchenkov fled to the United States. Alterations 
were then made to the LIMS database, including 
file deletion and creation of files under directories 
related to databases labelled “2012”, “2013, 
“2014”, “2015” and “forum_t’.%88 


(b) Evidence of these activities in logs generated by 
Automated Backup (daily) processes were 
selectively deleted. In addition, Logs showing 
backdating to 12 November 2015 were 
subsequently selectively deleted. 


(c) Over 450 database backups of the Moscow LIMS 
database created in 2016 were deleted from the 
Imaged Primary Disk. 


Notably, the Russia Forensic Investigation 
asserts that the system administrator deleted 
these backups after he copied them to his 
working computer to free up space on the Imaged 
Primary Disk. However, Independent Experts 
established that the Imaged Primary Disk had 
approximately 93% of “free space” available, 
more than enough for LIMS operations. In other 
words, files did not need to be moved as enough 
free space already existed on the disk. 


Additionally, Independent Experts did not find the 
“copied” backups in the New Data, despite the 
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New Data purportedly containing a forensic copy 
of the System Administrator's computer. 


(d) A Zeroing Command was executed on the 
Imaged Primary Disk for anywhere up to 170 
minutes. This command overwrites the free 
space of a disk with zeroes and renders 
unrecoverable all traces of prior commands, 
activities or previously deleted data. In other 
words, potentially a substantial amount of data. 


(e) A specific command was then executed which 
irretrievably deleted information as to the precise 
number of zeros written on the Imaged Primary 
Disk and the exact length of time the Zeroing 
Command operated. 


(f) The system date was then returned to 17 
December 2018. 


(g) The LIMS system was then backdated to 11 
August 2015 - a time when Doctor Rodchenkov 
was still Director of the Laboratory. 


(h) Whilst the system was backdated, the Imaged 
Secondary Disk was formatted so that it now 
falsely appeared to have been formatted on 11 
August 2015. Formatting sets up the file system 
and cleans all references to existing and already 
allocated files. Formatting does not overwrite a 
disk with zeros. 


However, at the time of formatting the Imaged 
Secondary Disk contained no data, only zeros. 
While executing a Zeroing Command on the 
Imaged Secondary Disk would explain the zeros, 
Independent Experts could not find observable 
forensic evidence of this occurrence. 


(i) After formatting, the Imaged Secondary Disk was 
never remounted or used to store data. 


(j) The commands to overwrite free space with 
zeros, backdate the LIMS system and format the 
Imaged Secondary Disk were selectively deleted 
from the history files (Command Logs). 


Command Logs are a means for identifying 
commands executed on a system, including 
modifications to the system and a database. The 
effect of deleting Command Logs is that the 
associated actions (zeroing, backdating and 
formatting) are invisible without digital forensic 
analysis. 


384 Recycle Bin: is a location where deleted files or folders are 
temporarily stored. 
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On 8 January 2019, the system administrator executed 
a script containing commands that backdated the LIMS 
system to 23 May 2015 and then: 


(a) replaced the LIMS database with a prior version 
(Prior Version); 


(b) deleted 632 LIMS database files (e.g. OPT, MYD, 
MYI and FRM); 


(c) backdated the timestamps of all database files. 


(dq) MrMochalov then used automated scripts to alter 
the LIMS database and backdate multiple 
databases and associated files to various dates. 


(e) Mr Mochalov then deleted scripts designed to 
alter and backdate the LIMS database. 


The effect of these actions is that Prior Version now 
falsely appeared to have been on the LIMS system 
since 23 May 2015. 


An attempt was then made to restore the LIMS system 
back to the correct date of 8 January 2019, however, 
the system administrator erroneously set the date to 1 
August 2019. The system then remained on 1 August 
2019 until it autocorrected at 03:05 hours (3:05AM) and 
reverted to the true date. 


Analysis subsequently identified three instances where 
the digital forensic evidence shows that between 6 
January 2019 and 9 January 2019, LIMS data indicative 
of doping was manipulated and or deleted to the 
betterment of the athletes (i.e. concealment of potential 
doping) in relation to three athletes, including one from 
the Target Group. 


Between 1 January 2019 and 9 January 2019 
(inclusively), 19,982 files and folders were deleted from 
the LIMS server, computer instruments and associated 
recycle bins,*® including 11,720 Sequence files, 531 
PDFs and 337 Raw Data files. Of which, when 
considering files that were not in the recycle bin, 
9,298 Sequence files, 500 PDFs and 1 Raw Data file 
had a creation timestamp between 1 January 2012 and 
31 December 2015. In other words, material analytical 
files created within the relevant LIMS period were 
deleted. 


On 9 January 2019, WADA arrived in Moscow to obtain 
a forensic copy of the Moscow Data. WADA did not 
enter the Laboratory until the following day (10 January 
2019). 
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On 9 January 2019, the following events occurred in the 
Moscow Laboratory: 


(a) The 2008, 2009, 2010 and 2011 Moscow LIMS 
databases were deleted from the Moscow LIMS 
database. 


(b) The Forum Message table (containing the 
fabricated and modified messages, and absent 
the deleted messages) was restored onto the 
LIMS database. 85 


On 10 January 2019, the following events occurred in 
the Moscow Laboratory: 


(a) 101 Sequence files and 137 PDFs were deleted 
from The Primary Disk. 


(b) late morning, WADA entered the Moscow 
Laboratory and inspected the _ specialised 
equipment to be used to forensically image the 
Moscow Data. 


On 11 January 2019, WADA commenced forensically 
imaging of the Moscow Data, beginning with three disks 
provided by the ICR (i.e. ICR Disks). 


On 14 January 2019, following a request by Russian 
Experts, WADA allowed the System Administrator to 
backup Server One to a new server to protect against 
data loss during forensic imaging of Server One. 


On 16 January 2019, the following events occurred in 
the Moscow Laboratory: 


(a) Server ONE was backdated to 19 August 2015 
and a_ system  administrator?®° executed 
commands to format a secondary disk, making it 
appear that the disk was formatted on 19 August 
2015. 


(b) A command was executed to overwrite the “free 
space” of the primary disk in Server ONE with 
zeroes. 


(c) In addition, Server ONE contains digital traces 
compatible with a specialized tool being used to 
secure erase files on 16 January 2019. 


(d) Asystem administrator selectively removed from 
Command Logs on Server ONE that overwrite 
areas of a disk with zeroes and run a specialized 
tool to secure erase files. 


As stated, ooverwriting the free space of a disk 
with zeroes renders unrecoverable all traces of 


385 This event occurred undoubtedly occurred between 5 January 
2019 and 10 January 2019, Independent Experts believe the 9 
January 2019 to be the more possible date. 
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prior commands, activities or previously deleted 
data. 


On 16 January 2019, after these activities by the system 
administrator, WADA were advised that the backup of 
Server One was complete and could now forensically 
image Server One. 


On 17 January 2019, WADA departed Moscow with a 
forensic image of the Moscow Data. 


Expert Meeting 


During the expert meeting, Russian Experts did not 
provide evidence or further technical material which 
required the Independent Experts to revisit their 
reported findings. 


Minister Kolobkov has personally undertaken to ensure 
Russian Experts investigate the fabricated, modified 
and deleted Forum Messages as well as the instances 
of deleted and manipulated LIMS data between 6 and 9 
January 2019. 


Impact 
Raw Data and PDFs 


There are 110 Raw Data files and 120 PDFs absent 
from the Moscow Data that are material to the 
investigation of Target Group athletes. 


The absence of Raw Data and PDF files appears 
targeted and has materially affected the ability to 
pursue ADRVs against the respective athletes. 


Minister Kolobkov has personally undertaken to ensure 
all possible efforts are made to locate and recover all 
absent Raw Data files. 


To date, 9 ITP Raw Data files have been identified 
which are suspected to have been manipulated. 


Independent Experts observed no digital trace of 
manipulation in the 9 ITP Raw Data files. 


Manipulation of Raw Data appears restricted to ITP 
Raw Data. 


Raw Data manipulation appears restricted to instances 
where there is a discrepancy between the WADA LIMS 
and Moscow LIMS. 


ThermoFisher continue to investigate the ability to 
identify digital trace evidence of Raw Data file 
manipulation. 


386 Whilst this is suspected to have been Mr Mochalov, to date, this 
has not been acknowledged by Russian authorities. 


59 


CONFIDENTIAL 


WORLD 
ANTI-DOPING 
AGENCY 


Anti-Doping Rule Violations 


To date, the Intelligence and Investigations Department 
has identified and forwarded prospective ADRV cases 
to the International Weightlifting Federation (IWF) (41 
athletes), United World Wrestling (1 athlete), World 
Taekwondo (2 athletes) and the International Canoe 
Federation (ICF) (1 athlete). 


Of the 41 cases provided to the IWF, 12 athletes have 
been “notified” of ADRV proceedings and provisionally 
suspended. Notably, upon review of the case, the ICF 
has declined to purse an ADRV against the athlete. 


The Intelligence and Investigations Department has 
also provided the International Association of Athletics 
Federations (IAAF) with the data of all IAAF athletes, 
including that of the 66 IAAF athletes included in the 
Target Pool. 


Two cases have also been commenced by the 
International Biathlon Union against two athletes 
outside of the Target Group. The Intelligence and 
Investigations Department are assisting the IBU in this 
regard. 


The targeted reanalysis of samples retrieved from the 
Moscow Laboratory as part of the Reinstatement 
Conditions has, to date, resulted in 14 Adverse 
Analytical Findings (AAFs) from 94 _ samples 
reanalysed. The 14 AAFs come from three International 
Federations. Results Management of the 14 AAFs is 
being undertaken by RUSADA with the close 
assistance of the Intelligence and _ Investigations 
Department. 


18.1.5 Conclusion 


Taken in its totality, the above evidence is capable of 
establishing, to the required standard of proof, that the 
Moscow Data was intentionally altered prior and during 
to it being forensically copied by WADA. To this end, 
the Reinstatement Conditions are not fulfilled in that the 
Moscow Data is neither a complete nor authentic copy. 
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19 ANNEXURES 


Attachment No. Description 
A WADA Technical Report (“PFS 19.0333"). 
B Russia Statement of Facts. 
Cc Russia Technical Report (Parts 1 and 2). 
D Russia Counter Research. 
E Answers to Technical Questions (Parts 1 and 2). 
F WADA Alteration Report (“PFS 19.0425”). 
G WADA Evaluation Report (“PFS 19.0426”). 
H WADA ICR Disk Report (“PFS 19.0427”). 
| WADA New Data Report (“PFS 19.0431”). 
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20 TERMINOLOGY 


Digital traces are defined as any modification of a given environment resulting from a completed event. 


The evaluative terminology used in this report is based on a standard verbal scale (the left column in the table below). 
The selection of the specific verbal term is based on expert knowledge, experience in research and casework, etc. To 
promote the transparency for the reader and the uniformity among the different experts, the European Network of 
Forensic Science Institutes has defined the verbal terms numerically. These definitions are expressed in orders of 
magnitude and are listed in the right column in the table below. For example, the term “slightly more probable” means 
that the probability of observing the results of the investigation is considered 2 to 10 times larger when one hypothesis 
is true than when the other hypothesis is true. 


The conclusion expresses the evidential strength of the results regarding the hypotheses. The conclusion does not 
represent the probability that a hypothesis is true. That probability depends on other evidence and information outside 
the domain of forensic expertise and falls outside the scope of this report 


Verbal equivalent Order of magnitude 
of evidential strength 
approximately equally probable 1-2 
slightly more probable 2-10 
more probable 10-100 
appreciably more probable 100-1,000 
much more probable 1,000-10,000 
far more probable 10,000-1,000,000 
extremely more probable >1,000,000 
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